CVE-2020-2114 Jenkins S3 Publisher Plugin transmits credentials in plain text during configuration
The Jenkins S3 publisher plugin exposes configured credentials in plain text within the global configuration form, allowing attackers to steal sensitive access keys.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-2114?
CVE-2020-2114 is a high-severity vulnerability in Jenkins S3 publisher Plugin, published on 12 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jenkins S3 publisher Plugin 0.11.4 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
Weakness: CWE-522
Which versions are affected by CVE-2020-2114?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:s3. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:s3 Maven | All versions | 0.11.5 |
org.jenkins-ci.plugins:s3 Maven | All versions | 0.11.5 |
Products include Jenkins S3 Publisher.
How do I fix CVE-2020-2114?
Upgrade org.jenkins-ci.plugins:s3 to 0.11.5 or later.
Is CVE-2020-2114 being exploited?
There is no known exploitation of CVE-2020-2114 in the wild and no public exploit code.
Other vulnerabilities in Jenkins S3 publisher Plugin
Sources
Also known as GHSA-ffr6-8cv5-j637.