-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability exists because the Jenkins IBM Cloud DevOps Plugin stores SonarQube authentication tokens as plain text in the config.xml files. This is a direct result of using String data types for sensitive information instead of the Jenkins-provided hudson.util.Secret class, which is designed to handle encrypted secrets. The analysis identified several key functions that contribute to this vulnerability. The getSonarQubeToken method in the CloudPublisher class directly exposes the token as a String. The doCheckSonarQubeToken method in the DescriptorImpl class validates the token as a plain String, and the getSonarQubeToken method in the same class retrieves the globally configured token as a String. These functions, by handling the token as a plain String, are the root cause of the information exposure vulnerability. An attacker with read access to the Jenkins controller's file system or with Item/Extended Read permission can exploit this to retrieve the SonarQube authentication tokens.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.ibm.devops:ibm-cloud-devops | maven | <= 2.0.16 |