Miggo Logo
Miggo Vulnerability Database
→
CVE-2019-1003061

CVE-2019-1003061: Jenkins CloudFormation Plugin stores credentials in plain text

4.3

CVSS Score
3.0

Basic Information

CVE ID
CVE-2019-1003061
GHSA ID
GHSA-xjrr-5jpv-v6mw
EPSS Score
0.33475%
CWE
CWE-311
Published
5/13/2022
Updated
12/21/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jenkins-ci.plugins:jenkins-cloudformation-pluginmaven<= 1.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from storing AWS secret keys as plain text strings in Jenkins job config.xml files. The commit d492ecc shows these functions previously used String types for AWS secret keys, which were serialized unencrypted. The fix replaced String with Jenkins' Secret type, which handles encryption. The getters for awsSecretKey in PostBuildStackBean, SimpleStackBean, and StackBean classes directly returned plain text credentials before this change, making them the vulnerable entry points.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

J*nkins *lou**orm*tion Plu*in stor*s *r***nti*ls un*n*rypt** in jo* `*on*i*.xml` *il*s on t** J*nkins *ontroll*r. T**s* *r***nti*ls **n ** vi*w** *y us*rs wit* *xt*n*** R*** p*rmission, or ****ss to t** J*nkins *ontroll*r *il* syst*m. * *ix w*s r*l*

Reasoning

T** vuln*r**ility st*mm** *rom storin* *WS s**r*t k*ys *s pl*in t*xt strin*s in J*nkins jo* `*on*i*.xml` *il*s. T** *ommit ******* s*ows t**s* `*un*tions` pr*viously us** `Strin*` typ*s *or *WS s**r*t k*ys, w*i** w*r* s*ri*liz** un*n*rypt**. T** *ix