Description
Jenkins SoapUI Pro Functional Testing Plugin 1.3 and earlier stores project passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by attackers with Extended Read permission, or access to the Jenkins controller file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2020/09/01/3
https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1631%20%281%29
Related Vulnerabilities
CVE-2021-42340 Vulnerability in maven package org.apache.tomcat:tomcat-websocket
CVE-2021-23673 Vulnerability in npm package pekeupload
CVE-2021-36686 Vulnerability in npm package yapi-vendor
CVE-2023-45143 Vulnerability in maven package org.webjars.npm:undici
CVE-2019-10417 Vulnerability in maven package io.fabric8.pipeline:kubernetes-pipeline-devops-steps