CVE-2020-2210 Passwords transmitted in plain text by Jenkins Stash Branch Parameter Plugin
Attackers can view configured passwords in plain text via the global configuration form, exposing sensitive credentials to unauthorized users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-2210?
CVE-2020-2210 is a medium-severity vulnerability in Jenkins Stash Branch Parameter Plugin, published on 2 Jul 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
Weakness: CWE-319
Which versions are affected by CVE-2020-2210?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:StashBranchParameter. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:StashBranchParameter Maven | All versions to 0.3.0 | None |
org.jenkins-ci.plugins:StashBranchParameter Maven | All versions to 0.3.0 | None |
Products include Jenkins Stash Branch Parameter.
How do I fix CVE-2020-2210?
No fix has been published for CVE-2020-2210 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-2210 being exploited?
There is no known exploitation of CVE-2020-2210 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Stash Branch Parameter Plugin
Sources
Also known as GHSA-3f82-v3qw-53q7.