Description
Jenkins SoapUI Pro Functional Testing Plugin 1.3 and earlier stores project passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by attackers with Extended Read permission, or access to the Jenkins controller file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2020/09/01/3
https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1631%20%281%29
Related Vulnerabilities
CVE-2020-28435 Vulnerability in npm package ffmpeg-sdk
CVE-2020-2110 Vulnerability in maven package org.jenkins-ci.plugins:script-security
CVE-2020-7760 Vulnerability in maven package org.webjars.bower:codemirror
CVE-2020-11612 Vulnerability in maven package io.netty:netty-codec
CVE-2020-7780 Vulnerability in maven package com.softwaremill.akka-http-session:core_2.11