CVE-2019-10440: Jenkins NeoLoad Plugin stores credentials in cleartext
Summary
CVE-2019-10440: Jenkins NeoLoad Plugin stores credentials in cleartext. Affects org.jenkins-ci.plugins:neoload-jenkins-plugin versions < 2.2.6. Fixed in 2.2.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins NeoLoad Plugin is a Maven package that provides integration between Jenkins and NeoLoad, a load testing platform. It allows users to configure and execute load tests as part of their Jenkins pipelines. The plugin is widely used in software development and continuous integration workflows.
Vulnerability Detail
The Jenkins NeoLoad Plugin prior to version 2.2.6 has a vulnerability that results in the storage of credentials in cleartext. This means that sensitive information such as usernames and passwords are not properly encrypted and can be easily accessed by users with Extended Read permission or those who have access to the Jenkins master file system. This vulnerability poses a significant risk as it allows unauthorized individuals to view and potentially misuse the stored credentials, compromising the security of the Jenkins environment and any associated systems.
How To Fix
Minimum fixed version
2.2.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the Jenkins NeoLoad Plugin to address the issue.
Conclusion
The Jenkins NeoLoad Plugin prior to version 2.2.6 has a vulnerability that allows credentials to be stored in cleartext, posing a significant security risk. Users should upgrade to version 2.2.6 or later to fix the issue. It is important to promptly address this vulnerability to prevent unauthorized access to sensitive systems and data. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:neoload-jenkins-plugin →
FAQ
This vulnerability allows unauthorized users to view and potentially misuse stored credentials in the Jenkins NeoLoad Plugin. It can lead to unauthorized access to sensitive systems and data.
Users of the Jenkins NeoLoad Plugin prior to version 2.2.6 are affected by this vulnerability. It is recommended for all users to upgrade to the fixed version.
There are no known public exploits for this vulnerability at the time of this advisory. However, it is crucial to address the issue promptly to prevent any potential unauthorized access.
No, this vulnerability requires either Extended Read permission or access to the Jenkins master file system to exploit. However, it is still a significant security risk and should be addressed.
There is no evidence of active exploitation of this vulnerability at the time of this advisory. However, it is recommended to upgrade to the fixed version to mitigate any potential risks.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
