Jenkins Project Inheritance Plugin Vulnerability Exposing Sensitive Data

CVE-2020-2198

What is CVE-2020-2198?

The Jenkins Project Inheritance Plugin is affected by a vulnerability that fails to properly redact encrypted secrets within the 'getConfigAsXML' API. This allows unauthorized users to access sensitive job configuration data, including secrets that should be protected, when job configuration XML data is transmitted. Users without adequate permissions risk exposure to confidential information, highlighting a significant security concern for organizations using this plugin in their Jenkins instances.

References