QwikSec

Security Database

CVE

CWE

Training

CVE-2020-2250

Published: Sep 1, 2020

Modified: Aug 4, 2024

PUBLISHED

Description

Jenkins SoapUI Pro Functional Testing Plugin 1.3 and earlier stores project passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by attackers with Extended Read permission, or access to the Jenkins controller file system.

Vendor	Product	Versions
Jenkins project	Jenkins SoapUI Pro Functional Testing Plugin	affected `unspecified - <= 1.3`

References

https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1631%20%281%29

x_refsource_CONFIRM

[oss-security] 20200901 Multiple vulnerabilities in Jenkins plugins

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.