CVE-2020-2155 Credentials transmitted in plain text by OpenShift Deployer Plugin

Medium 5.3 Published 9 Mar 2020 Updated 4 Aug 2024

Attackers can view OpenShift credentials in plain text via the Jenkins configuration form, exposing sensitive authentication data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-2155?

CVE-2020-2155 is a medium-severity vulnerability in Jenkins OpenShift Deployer Plugin, published on 9 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Jenkins OpenShift Deployer Plugin 1.2.0 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.

Weakness: CWE-319

Which versions are affected by CVE-2020-2155?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:openshift-deployer. It affects 1 product.

Package	Affected	Fixed in
`org.jenkins-ci.plugins:openshift-deployer` Maven	All versions to `1.2.0`	None
`org.jenkins-ci.plugins:openshift-deployer` Maven	All versions to `1.2.0`	None

Products include Jenkins Openshift Deployer.

How do I fix CVE-2020-2155?

No fix has been published for CVE-2020-2155 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-2155 being exploited?

There is no known exploitation of CVE-2020-2155 in the wild and no public exploit code.

Sources

Also known as GHSA-2rrx-q65f-8945.