github - ghsa-99jc-v8pq-6qm4

GHSA-99JC-V8PQ-6QM4

Vulnerability from github – Published: 2022-05-13 01:15 – Updated: 2023-10-25 21:26

Summary

Jenkins Repository Connector Plugin has insufficiently protected credentials

Details

Jenkins Repository Connector Plugin stored the username and password in its configuration unencrypted in its global configuration file on the Jenkins controller. This password could be viewed by users with access to the Jenkins controller file system.

The plugin now stores the password encrypted in the configuration files on disk and no longer transfers it to users viewing the configuration form in plain text.

Severity ?

3.3 (Low)


                  
                    CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.2.4"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.plugins:repository-connector"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-1003038"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-522"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-25T21:26:07Z",
    "nvd_published_at": "2019-03-08T21:29:00Z",
    "severity": "LOW"
  },
  "details": "Jenkins Repository Connector Plugin stored the username and password in its configuration unencrypted in its global configuration file on the Jenkins controller. This password could be viewed by users with access to the Jenkins controller file system.\n\nThe plugin now stores the password encrypted in the configuration files on disk and no longer transfers it to users viewing the configuration form in plain text.",
  "id": "GHSA-99jc-v8pq-6qm4",
  "modified": "2023-10-25T21:26:07Z",
  "published": "2022-05-13T01:15:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003038"
    },
    {
      "type": "WEB",
      "url": "https://jenkins.io/security/advisory/2019-03-06/#SECURITY-958"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20200227084009/http://www.securityfocus.com/bid/107476"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Jenkins Repository Connector Plugin has insufficiently protected credentials"
}

CVE-2019-1003038 (GCVE-0-2019-1003038)

Vulnerability from cvelistv5 – Published: 2019-03-08 21:00 – Updated: 2024-08-05 03:07

Summary

An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jvnet/hudson/plugins/repositoryconnector/ArtifactDeployer.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/Repository.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/UserPwd.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the password stored in the plugin configuration.

Severity ?

No CVSS data available.

Assigner

jenkins

References

URL

Tags

	https://jenkins.io/security/advisory/2019-03-06/#…	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/107476	vdb-entryx_refsource_BID

Impacted products

	Vendor	Product	Version
	Jenkins project	Jenkins Repository Connector Plugin	Affected: 1.2.4 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:07:16.687Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://jenkins.io/security/advisory/2019-03-06/#SECURITY-958"
          },
          {
            "name": "107476",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/107476"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Jenkins Repository Connector Plugin",
          "vendor": "Jenkins project",
          "versions": [
            {
              "status": "affected",
              "version": "1.2.4 and earlier"
            }
          ]
        }
      ],
      "dateAssigned": "2019-03-06T00:00:00",
      "datePublic": "2019-03-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jvnet/hudson/plugins/repositoryconnector/ArtifactDeployer.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/Repository.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/UserPwd.java that allows an attacker with local file system access or control of a Jenkins administrator\u0027s web browser (e.g. malicious extension) to retrieve the password stored in the plugin configuration."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-24T16:45:14.802Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://jenkins.io/security/advisory/2019-03-06/#SECURITY-958"
        },
        {
          "name": "107476",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/107476"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "jenkinsci-cert@googlegroups.com",
          "DATE_ASSIGNED": "2019-03-06T22:44:37.387698",
          "ID": "CVE-2019-1003038",
          "REQUESTER": "ml@beckweb.net",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Jenkins Repository Connector Plugin",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "1.2.4 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Jenkins project"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jvnet/hudson/plugins/repositoryconnector/ArtifactDeployer.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/Repository.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/UserPwd.java that allows an attacker with local file system access or control of a Jenkins administrator\u0027s web browser (e.g. malicious extension) to retrieve the password stored in the plugin configuration."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-522"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://jenkins.io/security/advisory/2019-03-06/#SECURITY-958",
              "refsource": "CONFIRM",
              "url": "https://jenkins.io/security/advisory/2019-03-06/#SECURITY-958"
            },
            {
              "name": "107476",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/107476"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2019-1003038",
    "datePublished": "2019-03-08T21:00:00",
    "dateReserved": "2019-03-08T00:00:00",
    "dateUpdated": "2024-08-05T03:07:16.687Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-99JC-V8PQ-6QM4

CVE-2019-1003038 (GCVE-0-2019-1003038)

Tags

Sightings

Nomenclature