CVE-2020-2119
First published: Wed Feb 12 2020(Updated: )
Azure AD Plugin stores a client secret in its global configuration. While the credential is stored encrypted on disk, it is transmitted in plain text as part of the configuration form by Azure AD Plugin 1.1.2 and earlier. This can result in exposure of the credential through browser extensions, cross-site scripting vulnerabilities, and similar situations. Azure AD Plugin 1.2.0 transmits the client secret in its global configuration encrypted.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Azure Ad | <=1.1.2 | |
| maven/org.jenkins-ci.plugins:azure-ad | <1.2.0 | 1.2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-2119?
CVE-2020-2119 is a vulnerability in Jenkins Azure AD Plugin 1.1.2 and earlier that transmits configured credentials in plain text.
How severe is CVE-2020-2119?
CVE-2020-2119 has a severity value of 5.3 out of 10, which is considered medium severity.
How does CVE-2020-2119 impact the user?
CVE-2020-2119 can expose the stored credentials through browser extensions and potentially lead to unauthorized access.
What is the recommended solution for CVE-2020-2119?
Upgrading to Jenkins Azure AD Plugin version 1.2.0 or newer is recommended to fix CVE-2020-2119.
Where can I find more information about CVE-2020-2119?
You can find more information about CVE-2020-2119 on the following websites: [Openwall](http://www.openwall.com/lists/oss-security/2020/02/12/3), [Jenkins.io](https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1717), and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-2119).
- collector/nvd-index
- collector/nvd-api
- collector/github-advisory-latest
- alias/GHSA-vvg2-hg3c-mqj3
- alias/CVE-2020-2119
- collector/github-advisory
- collector/nvd-cve
- agent/event
- agent/type
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/jenkins
- canonical/jenkins azure ad
- version/jenkins azure ad/1.1.2
- package-manager/maven