PT-2021-14657 · Jenkins · Jenkins Bumblebee Hp Alm Plugin+1

S0Nnguy3N + 1 · Published 2021-01-13 · Updated 2023-10-25 · CVE-2021-21614

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Bumblebee HP ALM Plugin versions 4.1.5 and earlier

Description The issue concerns the storage of credentials in an unencrypted manner within the global configuration file on the Jenkins controller. Specifically, the credentials are stored in the com.agiletestware.bumblebee.BumblebeeGlobalConfig.xml file. Users with access to the Jenkins controller file system can view these credentials. It is noted that credentials are stored encrypted in version 4.1.6 once the configuration is saved again.

Recommendations For Jenkins Bumblebee HP ALM Plugin versions 4.1.5 and earlier, update to version 4.1.6 or later to ensure credentials are stored encrypted. As a temporary workaround, consider restricting access to the Jenkins controller file system to minimize the risk of credential exposure.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2021-21614

GHSA-8V72-QR3H-C6RV

Affected Products

Jenkins

Jenkins Bumblebee Hp Alm Plugin

References · 8

• https://jenkins.io/security/advisory/2021-01-13/#SECURITY-2156 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21614 · Security Note
• https://osv.dev/vulnerability/GHSA-8v72-qr3h-c6rv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21614 · Vendor Advisory
• https://github.com/jenkinsci/bumblebee-plugin · Note
• https://github.com/jenkinsci/bumblebee-plugin/commit/7faf4bd6e702726bb7542f370cbdedcbfa340443 · Note
• https://t.me/cibsecurity/22081 · Telegram Post
• https://t.me/cvenotify/8478 · Telegram Post