In this case, the Apprenda Plugin has been configured to expose this data to external tools, such as Pivotal’s Cloud Access Manager (CAM), so that administrators can audit the credentials stored in their on-premises Jenkins instances. This issue has been fixed in Apprenda Plugin 2.2.1. You should upgrade to 2.2.1 as soon as possible to prevent credential enumeration in external tools.
What is the Apprenda Plugin?
The Apprenda Plugin is an open source plugin that provides Jenkins administrators with a way to store credentials in the on-premises Jenkins instance alongside other data and can be used as a means of auditing those credentials.
Summary of the vulnerability
Apprenda Plugin 2.2.1 has been released, which fixes the vulnerability that allowed unauthenticated attackers to enumerate credentials in Jenkins instances where Apprenda Plugin was configured with external authentication.
The importance of digital marketing
-89% of marketers say that digital marketing methods like SEO are successful.
-With digital marketing you can target your audience more precisely than traditional methods, which leads to better conversion rates and lower costs.
-In addition, you can use pictures in your ads campaigns on Facebook as people respond well to pictures.
-You can target your ideal audience by using the information you have about them from other sources and using it to shape your digital marketing campaigns
What you should do to protect your Jenkins instance from being exploited
In order to protect your Jenkins instance from being exploited, you need to ensure that your credentials are not exposed to external tools. To do this, you should follow the steps outlined in the Apprenda Plugin documentation.
Ensure that you have access to all of your data. This means that if you are using a master password, then use different passwords for each user and role. Using unique passwords makes it much harder for attackers to gain access to the data they need. The Apprenda Plugin is configured to expose credentials stored in your on-premises Jenkins instances as well as data stored in other directories or databases where credentials may be stored so that administrators can audit their credential storage practices. You must take precautions against these exposure points by ensuring that external tools cannot obtain these credentials.
How users can be exposed to the Apprenda Plugin
Many users of Apprenda Plugin store their credentials in their on-premise Jenkins instance, either as a string or encrypted. If the credentials are stored in an external location, such as a file on the Jenkins server, then this issue does not affect them.
If you have configured your Apprenda Plugin to expose credentials to an external tool, then you should review the configuration for your Apprenda Plugin and upgrade to 2.2.1.
Timeline
Published on: 09/21/2022 16:15:00 UTC
Last modified on: 09/22/2022 18:40:00 UTC