CVE-2017-1000387: Insufficiently Protected Credentials

January 26, 2018 (updated October 3, 2019)

Jenkins Build-Publisher stores credentials to other Jenkins instances in the file hudson.plugins.build_publisher.BuildPublisher.xml in the Jenkins master home directory. These credentials were stored unencrypted, allowing anyone with local file system access to access them. Additionally, the credentials were also transmitted in plain text as part of the configuration form. This could result in exposure of the credentials through browser extensions, cross-site scripting vulnerabilities, and similar situations.

References

www.securityfocus.com/bid/101544
jenkins.io/security/advisory/2017-10-23/
nvd.nist.gov/vuln/detail/CVE-2017-1000387

Code Behaviors & Features

Detect and mitigate CVE-2017-1000387 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →