CVE-2020-2107 Fortify Plugin stored credentials in plain text

What is CVE-2020-2107?

CVE-2020-2107 is a medium-severity vulnerability in Jenkins Fortify Plugin, published on 29 Jan 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Jenkins Fortify Plugin 19.1.29 and earlier stores proxy server passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Weakness: CWE-522

Which versions are affected by CVE-2020-2107?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:fortify. It affects 1 product.

Products include Jenkins Fortify.

How do I fix CVE-2020-2107?

Upgrade org.jenkins-ci.plugins:fortify to 19.2.30 or later.

Is CVE-2020-2107 being exploited?

There is no known exploitation of CVE-2020-2107 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Fortify Plugin

• CVE-2023-4303 HTML injection vulnerability in Fortify Plugin Medium 4.3
• CVE-2022-25188 Path traversal vulnerability in Jenkins Fortify Plugin Medium 4.3
• CVE-2023-4301 CSRF vulnerability in Fortify Plugin allow capturing credentials Medium 4.2
• CVE-2023-4302 Missing permission checks in Fortify Plugin allow capturing credentials Medium 4.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xr37-pjfh-qwwc.