CVE-2020-2145: Zephyr Enterprise Test Management Plugin - Credentials Stored in Plain Text
Summary
CVE-2020-2145: Credentials stored in plain text by Zephyr Enterprise Test Management Plugin. Affects org.jenkins-ci.plugins:zephyr-enterprise-test-management versions < 1.10. Fixed in 1.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zephyr Enterprise Test Management Plugin is a Maven package that provides test management capabilities for Jenkins. It allows users to manage and track test cases, test execution, and test results within the Jenkins environment. The plugin integrates with Zephyr Enterprise, a test management tool, to provide seamless test management functionality within Jenkins. However, versions 1.9.1 and earlier of the plugin have a vulnerability that exposes the Zephyr password stored in plain text in the global configuration file com.thed.zephyr.jenkins.reporter.ZeeReporter.xml. This vulnerability allows users with access to the Jenkins controller file system to view the password.
Vulnerability Detail
The vulnerability (CVE-2020-2145) in Zephyr Enterprise Test Management Plugin arises from the insecure storage of the Zephyr password. By storing the password in plain text, any user with access to the Jenkins controller file system can easily retrieve and view the password. This can lead to unauthorized access to the Zephyr Enterprise test management tool and potentially compromise the security and integrity of test cases, test execution, and test results stored within the tool. The vulnerability has a CVSS score of 3.3, indicating a low severity level.
How To Fix
Minimum fixed version
1.10
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the latest version of Zephyr Enterprise Test Management Plugin.
Conclusion
The Zephyr Enterprise Test Management Plugin has a vulnerability that exposes the Zephyr password stored in plain text, potentially leading to unauthorized access to the test management tool. To mitigate this vulnerability, it is crucial to upgrade to version 1.10 or later of the plugin, which securely stores the password using the Credentials Plugin. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:zephyr-enterprise-test-management →
FAQ
Zephyr Enterprise Test Management Plugin is a Maven package that integrates with Jenkins to provide test management capabilities. It allows users to manage and track test cases, test execution, and test results within the Jenkins environment.
This vulnerability exposes the Zephyr password stored in plain text, allowing unauthorized users with access to the Jenkins controller file system to view the password. This can lead to unauthorized access to the Zephyr Enterprise test management tool and potential compromise of test case, execution, and result data.
The CVSS score of this vulnerability is 3.3, indicating a low severity level.
To fix this vulnerability, it is recommended to upgrade to Zephyr Enterprise Test Management Plugin version 1.10 or later, which integrates with the Credentials Plugin for secure storage of sensitive information.
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the latest version of Zephyr Enterprise Test Management Plugin.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:zephyr-enterprise-test-management.
