Plain Text Credential Storage in Jenkins Plugin by CloudBees
CVE-2020-2154

5.5MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Zephyr For Jira Test Management Plugin
Vendor
CVE Published:
9 March 2020

Summary

The Jenkins Zephyr for JIRA Test Management Plugin, versions 1.5 and earlier, is vulnerable due to improper credential management. This plugin stores sensitive credentials in plain text within a global configuration file located on the Jenkins master file system. This poses significant risks, as unauthorized users with access to the file system can easily read these credentials, potentially leading to unauthorized access and further exploitation of the Jenkins environment.

Affected Version(s)

Jenkins Zephyr for JIRA Test Management Plugin <= 1.5

References

https://jenkins.io/security/advisory/2020-03-09/#SECURITY...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2020/03/09/1
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.