GHSA-gmg2-3w6v-945p

Password stored in plain text by Parasoft Environment Manager Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-2132

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.parasoft:environment-manager	< 2.15	2.15

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Parasoft Environment Manager Plugin 2.14 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-2132 advisory
https://github.com/jenkinsci/environment-manager-tools-plugin/commit/a2511b9d3dfbd3778471c6840ae6026076f11134 web
https://github.com/jenkinsci/environment-manager-tools-plugin package
https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1562 web
http://www.openwall.com/lists/oss-security/2020/02/12/3 web