PT-2020-15356 · Jenkins · Jenkins Zephyr Enterprise Test Management Plugin+2

James Holderness · Published 2020-03-09 · Updated 2023-10-25 · CVE-2020-2145

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Zephyr Enterprise Test Management Plugin versions 1.9.1 and earlier

Description The issue concerns the storage of the Zephyr password in plain text on the Jenkins master file system, specifically in the global configuration file com.thed.zephyr.jenkins.reporter.ZeeReporter.xml. This allows users with access to the Jenkins controller file system to view the password.

Recommendations For Jenkins Zephyr Enterprise Test Management Plugin versions 1.9.1 and earlier, update to version 1.10, which integrates with the Credentials Plugin to securely store the Zephyr password.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-256

CWE-522

Related Identifiers

CVE-2020-2145

GHSA-XV58-GP43-6M76

Affected Products

Credentials Plugin

Jenkins

Jenkins Zephyr Enterprise Test Management Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-2145 · Security Note
• https://osv.dev/vulnerability/GHSA-xv58-gp43-6m76 · Vendor Advisory
• https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1596 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2145 · Vendor Advisory
• http://openwall.com/lists/oss-security/2020/03/09/1 · Note
• https://plugins.jenkins.io/zephyr-enterprise-test-management · Note
• https://t.me/cvenotify/1404 · Telegram Post