Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1tMzY1LTk4ajgtdzk2d84AAjx3
Jenkins Zephyr for JIRA Test Management Plugin stores credentials in plain text
Zephyr for JIRA Test Management Plugin 1.5 and earlier stores Jira credentials unencrypted in its global configuration file com.thed.zephyr.jenkins.reporter.ZfjReporter.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tMzY1LTk4ajgtdzk2d84AAjx3
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: almost 2 years ago
Updated: 6 months ago
CVSS Score: 3.3
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Identifiers: GHSA-m365-98j8-w96w, CVE-2020-2154
References:
- https://nvd.nist.gov/vuln/detail/CVE-2020-2154
- https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1550
- http://www.openwall.com/lists/oss-security/2020/03/09/1
- https://github.com/advisories/GHSA-m365-98j8-w96w
Affected Packages
maven:org.jenkins-ci.plugins:zephyr-for-jira-test-management
Affected Version Ranges: <= 1.5No known fixed version