CVE-2020-2251

Jenkins SoapUI Pro Functional Testing Plugin 1.5 and earlier transmits project passwords in its configuration in plain text as part of job configuration forms, potentially resulting in their exposure.

Published: Sep 1, 2020
Updated: May 9, 2024
CVE: CVE-2020-2251
GHSA: GHSA-q4qq-8q2r-g2f2
Severity: Low
Exploit:

CVSS v3:

Severity: Low
Score: 4.3
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CVSS v2:

Severity: Low
Score: 4
AV:N/AC:L/Au:S/C:P/I:N/A:N

CWEs:

CWE-319

OWASP TOP 10:

A3 - Sensitive Data Exposure

Affected Software
References

Software	From	Fixed in
jenkins / jenkins	-	2.236
jenkins / soapui_pro_functional_testing	-	1.5.x
org.jenkins-ci.plugins / soapui-pro-functional-testing	-	1.6

http://www.openwall.com/lists/oss-security/2020/09/01/3
https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1631%20(2)
https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1631%20%282%29

Vulnerability Database

CVE-2020-2251