CVE-2020-2149
published 2020-03-09CVE-2020-2149: Jenkins Repository Connector Plugin 1.2.6 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form…
PriorityP425medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.61%
48.8th percentile
Jenkins Repository Connector Plugin 1.2.6 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | audit_trail_plugin | — | — |
| jenkins | backlog_plugin | — | — |
| jenkins | cobertura_plugin | — | — |
| jenkins | credentials_plugin | — | — |
| jenkins | cryptomove_plugin | — | — |
| jenkins | deployhub_plugin | — | — |
| jenkins | git_plugin | — | — |
| jenkins | literate_plugin | — | — |
| jenkins | logstash_plugin | — | — |
| jenkins | mac_cloud_host_launched_by_the_plugin | — | — |
| jenkins | mac_plugin | — | — |
| jenkins | openshift_deployer_plugin | — | — |
| jenkins | p4_plugin | — | — |
| jenkins | quality_gates_plugin | — | — |
| jenkins | repository_connector | <= 1.2.6 | — |
| jenkins | repository_connector_plugin | — | — |
| jenkins | rundeck_plugin | — | — |
| jenkins | sandbox_protection_in_script_security_plugin | — | — |
| jenkins | script_security_plugin | — | — |
| jenkins | skytap_cloud_ci_plugin | — | — |
| jenkins | sonar_quality_gates_plugin | — | — |
| jenkins | subversion_release_manager_plugin | — | — |
| jenkins | timestamper_plugin | — | — |
| jenkins | yaml_input_files_to_literate_plugin | — | — |
| jenkins | zephyr_enterprise_test_management_plugin | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Jenkins
Jenkins Security Advisory 2020-03-09
vendor_jenkins·2020-03-09·CVSS 8.8
CVE-2020-2134 [HIGH] Jenkins Security Advisory 2020-03-09
Title: Jenkins Security Advisory 2020-03-09
Jenkins Security Advisory 2020-03-09
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Audit Trail
Plugin
Backlog
Plugin
Cobertura
Plugin
CryptoMove
Plugin
DeployHub
Plugin
Git
Plugin
Literate
Plugin
Logstash
Plugin
Mac
Plugin
OpenShift Deploy
GHSA
Credentials transmitted in plain text by Repository Connector Plugin
ghsa·2022-05-24
CVE-2020-2149 [LOW] CWE-319 Credentials transmitted in plain text by Repository Connector Plugin
Credentials transmitted in plain text by Repository Connector Plugin
Repository Connector Plugin stores credentials in its global configuration file `org.jvnet.hudson.plugins.repositoryconnector.RepositoryConfiguration.xml` on the Jenkins controller as part of its configuration.
While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Repository Connector Plugin 1.2.6 and earlier. This can result in exposure of the credential through browser extensions, cross-site scripting vulnerabilities, and similar situations.
OSV
Credentials transmitted in plain text by Repository Connector Plugin
osv·2022-05-24
CVE-2020-2149 [LOW] Credentials transmitted in plain text by Repository Connector Plugin
Credentials transmitted in plain text by Repository Connector Plugin
Repository Connector Plugin stores credentials in its global configuration file `org.jvnet.hudson.plugins.repositoryconnector.RepositoryConfiguration.xml` on the Jenkins controller as part of its configuration.
While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Repository Connector Plugin 1.2.6 and earlier. This can result in exposure of the credential through browser extensions, cross-site scripting vulnerabilities, and similar situations.
Suricata
ET WEB_SPECIFIC_APPS PHP Aardvark Topsites PHP CONFIG PATH Remote File Include Attempt
suricata·2010-07-30·CVSS 6.4
CVE-2006-2149 [MEDIUM] ET WEB_SPECIFIC_APPS PHP Aardvark Topsites PHP CONFIG PATH Remote File Include Attempt
ET WEB_SPECIFIC_APPS PHP Aardvark Topsites PHP CONFIG PATH Remote File Include Attempt
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS PHP Aardvark Topsites PHP CONFIG PATH Remote File Include Attempt"; flow:established,to_server; http.uri; content:"CONFIG[PATH]="; nocase; pcre:"/(join|lostpw)\.php\?/i"; pcre:"/&CONFIG\x5bpath\x5d=(https?|ftps?|php)\:/i"; reference:cve,CVE-2006-2149; reference:url,www.osvdb.org/25158; classtype:web-application-attack; sid:2002901; rev:9; metadata:affected_product Any, attack_target Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag Remote_File_Include, updated_at 2020_09_10, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Pu
No public exploits indexed.
No writeups or analysis indexed.
2020-03-09
Published