Jenkins credentials stored with global scope

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_38
Category	Credential Hygiene
Severity	HIGH

Impact

By default, Jenkins credentials are stored under the global scope. Global scope credentials are accessible by all Jenkins jobs, which increases the risk of credential theft by executing a malicious job in the instance.

Recommended Solution - Buildtime

Avoid setting credentials with global scope. Instead, limit the scope of credentials so that the credentials are only accessible on jobs where they are required.

EXAMPLES

• Limit the scope of Jenkins credentials using folder scopes

  1. Install the Folders plugin.
  2. Create a folder for each group of pipelines that require access to a set of credentials, and move the pipelines to the folder.
  3. Create the credentials and set it with the folder’s scope.
• Limit the scope of Jenkins credentials using user scopes

  Refer to the instructions in the following link: https://docs.cloudbees.com/docs/admin-resources/latest/pipelines/user-scoped-creds#_adding_user_scoped_credentials_to_your_user_account.