CVE-2020-2154: Jenkins Zephyr for JIRA Test Management Plugin stores credentials in plain text
Summary
CVE-2020-2154: Jenkins Zephyr for JIRA Test Management Plugin stores credentials in plain text. Affects org.jenkins-ci.plugins:zephyr-for-jira-test-management versions < 1.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Zephyr for JIRA Test Management Plugin is a Maven package that provides integration between Jenkins and JIRA for managing test cases. It allows users to store and manage JIRA credentials within Jenkins. However, versions 1.5 and earlier of the plugin store these credentials in plain text in the global configuration file com.thed.zephyr.jenkins.reporter.ZfjReporter.xml on the Jenkins controller. This means that users with access to the Jenkins controller file system can view these credentials.
Vulnerability Detail
The vulnerability (CVE-2020-2154) arises from the insecure storage of JIRA credentials by the Zephyr for JIRA Test Management Plugin. As a result, any user with access to the Jenkins controller file system can potentially view these credentials. This can lead to unauthorized access to JIRA resources and compromise the security of the JIRA instance. The vulnerability has a CVSS score of 3.3, indicating a low severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by restricting access to the Jenkins controller file system, ensuring that only authorized personnel have access to the credentials file.
Conclusion
In conclusion, the Zephyr for JIRA Test Management Plugin versions 1.5 and earlier store JIRA credentials in plain text, making them vulnerable to unauthorized access. To address this issue, users should upgrade to a version of the plugin that securely stores the credentials. Restricting access to the Jenkins controller file system can also help mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:zephyr-for-jira-test-management →
FAQ
The vulnerability allows unauthorized users with access to the Jenkins controller file system to view JIRA credentials stored by the Zephyr for JIRA Test Management Plugin. This can lead to unauthorized access to JIRA resources and potential compromise of the JIRA instance.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
The CVSS score of this vulnerability is 3.3, indicating a low severity level.
Yes, the developers of the Zephyr for JIRA Test Management Plugin have released a fix in a later version. It is recommended to update your plugin installation to the latest version available.
While there is no specific workaround mentioned, you can mitigate the risk by restricting access to the Jenkins controller file system, ensuring that only authorized personnel have access to the credentials file.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:zephyr-for-jira-test-management.
