Description

Jenkins SOASTA CloudTest Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Remediation

References

https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1439

Related Vulnerabilities

CVE-2017-15697 Vulnerability in maven package org.apache.nifi:nifi-web-error

CVE-2020-6541 Vulnerability in maven package org.webjars.npm:electron

CVE-2019-10413 Vulnerability in maven package com.datatheorem.mobileappsecurity.jenkins.plugin:datatheorem-mobile-app-security

CVE-2019-10240 Vulnerability in maven package org.eclipse.hawkbit:hawkbit-parent

CVE-2018-1000056 Vulnerability in maven package org.jenkins-ci.plugins:junit

Severity

Medium

Classification

CWE-312 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Vendor Advisory