GHSA-xv58-gp43-6m76

Credentials stored in plain text by Zephyr Enterprise Test Management Plugin

Source: GitHub Advisory Database (reviewed) Low CVE-2020-2145

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:zephyr-enterprise-test-management	< 1.10	1.10

Details

As written in the advisory (Markdown source, shown as plain text).

Zephyr Enterprise Test Management Plugin 1.9.1 and earlier stores its Zephyr password in plain text in the global configuration file `com.thed.zephyr.jenkins.reporter.ZeeReporter.xml`. This password can be viewed by users with access to the Jenkins controller file system. Zephyr Enterprise Test Management Plugin 1.10 integrates with [Credentials Plugin](https://plugins.jenkins.io/credentials).

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-2145 advisory
https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1596 web
https://plugins.jenkins.io/zephyr-enterprise-test-management package
http://www.openwall.com/lists/oss-security/2020/03/09/1 web