PT-2020-15475 · Cloudbees+2 · Jenkins+2
Wasin Saengow
·
Published
2020-09-01
·
Updated
2024-03-06
·
CVE-2020-2251
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Jenkins SoapUI Pro Functional Testing Plugin versions 1.5 and earlier
ReadyAPI Functional Testing Plugin versions 1.5 and earlier
Jenkins versions prior to 2.236, including 2.235.x LTS
Description
The issue concerns the transmission of project passwords in plain text as part of job configuration forms, potentially exposing them. This is due to the storage of project passwords in job
config.xml files on the Jenkins controller as part of the plugin's configuration. Although passwords are stored encrypted on disk since version 1.4, they are transmitted in plain text by versions 1.5 and earlier. Attackers with Extended Read permission can view these passwords.Recommendations
For Jenkins SoapUI Pro Functional Testing Plugin versions 1.5 and earlier: Update to a version later than 1.5 to ensure passwords are not transmitted in plain text.
For ReadyAPI Functional Testing Plugin versions 1.5 and earlier: Update to a version later than 1.5 to prevent plain text transmission of passwords.
For Jenkins versions prior to 2.236, including 2.235.x LTS: Update to Jenkins version 2.236 or later to utilize the security hardening that encrypts and decrypts data used for Jenkins password form fields.
Fix
Cleartext Transmission of Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jenkins
Jenkins Soapui Pro Functional Testing Plugin
Readyapi Functional Testing Plugin