Description
Jenkins SoapUI Pro Functional Testing Plugin 1.3 and earlier stores project passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by attackers with Extended Read permission, or access to the Jenkins controller file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2020/09/01/3
https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1631%20%281%29
Related Vulnerabilities
CVE-2021-32860 Vulnerability in npm package izimodal
CVE-2019-12384 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2018-1000632 Vulnerability in maven package org.jenkins-ci.dom4j:dom4j
CVE-2022-25860 Vulnerability in maven package org.webjars.npm:simple-git
CVE-2022-36908 Vulnerability in maven package org.jenkins-ci.plugins:openshift-deployer