CVE-2020-2314

Vulnerability

The Jenkins AppSpider Plugin, up to version 1.0.12, stores a password unencrypted in its global configuration file on the Jenkins controller [1]. This means the password is saved in plaintext, making it accessible to any user who can read the controller's file system [2].

Exploitation

An attacker with access to the Jenkins controller file system can retrieve the stored password directly from the configuration file. No authentication is required beyond the ability to read files; the password is not encrypted or obfuscated [1,2].

Impact

Once the plaintext password is obtained, an attacker can use it to gain unauthorized access to the AppSpider service, which could lead to further compromise of scan configurations and results handled by the plugin [1].

Mitigation

Users should update the Jenkins AppSpider Plugin to a version newer than 1.0.12 where the password is stored securely. As of the advisory date, no workaround is provided other than upgrading [1,2].