4.3med
CVE-2020-2124
Password stored in plain text by Dynamic Extended Choice Parameter Plugin
Also known as GHSA-h6pp-v4j6-w76c
Published 6 y ago · modified 4 mo ago · JSON
CVSS
4.3
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.7%
percentile 53%
Public exploits
0
none known
Summary
Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.
Exploit prediction (EPSS)
0.69% probability of exploitation in the next 30 days, higher than 53% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter | <=1.0.1 | no fix listed |
Affected products
- Jenkins project Jenkins Dynamic Extended Choice Parameter Plugin
Classification
References
- jenkins.io /security/advisory/2020-02-12/#SECURITY-1560 · x_refsource_CONFIRM, x_transferred
- openwall.com /lists/oss-security/2020/02/12/3 · mailing-list, x_refsource_MLIST, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2020-2124 · advisory
- github.com /jenkinsci/dynamic-extended-choice-parameter-plugin · package
Sources
- CVE List: CVE-2020-2124
- GitHub Advisory: GHSA-h6pp-v4j6-w76c
- NVD: CVE-2020-2124
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.