CVE-2020-2250

Jenkins SoapUI Pro Functional Testing Plugin 1.3 and earlier stores project passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by attackers with Extended Read permission, or access to the Jenkins controller file system.

Score

CVSS 3.1 6.5 Medium

Status

Modified - jenkinsci-cert@googlegroups.com

Published

2020-09-01

Last modified

2024-08-04

Weaknesses

CWE-311

Affected products

• Soapui Pro Functional Testing (Jenkins)
• Jenkins Soapui Pro Functional Testing Plugin (Jenkins Project)

References

• http://www.openwall.com/lists/oss-security/2020/09/01/3
• https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1631%20%281%29