PT-2020-15371 · Jenkins+1 · Jenkins Zephyr For Jira Test Management Plugin+2

Published 2020-03-09 · Updated 2023-10-25 · CVE-2020-2154

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Zephyr for JIRA Test Management Plugin versions 1.5 and earlier

Description The issue concerns the storage of credentials in plain text in a global configuration file on the Jenkins master file system. Specifically, the Zephyr for JIRA Test Management Plugin stores Jira credentials unencrypted in its global configuration file com.thed.zephyr.jenkins.reporter.ZfjReporter.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system.

Recommendations For versions 1.5 and earlier, consider restricting access to the Jenkins controller file system to minimize the risk of exploitation. As a temporary workaround, restrict access to the global configuration file com.thed.zephyr.jenkins.reporter.ZfjReporter.xml until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-256

CWE-312

Related Identifiers

CVE-2020-2154

GHSA-M365-98J8-W96W

Affected Products

Jenkins

Jenkins Zephyr For Jira Test Management Plugin

Jira

References · 7

• https://osv.dev/vulnerability/GHSA-m365-98j8-w96w · Vendor Advisory
• https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1550 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2154 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2154 · Security Note
• https://github.com/jenkinsci/zephyr-for-jira-test-management-plugin · Note
• http://openwall.com/lists/oss-security/2020/03/09/1 · Note
• https://t.me/cvenotify/1412 · Telegram Post