CVE-2020-2250: Passwords stored in plain text by Jenkins ReadyAPI Functional Testing Plugin
Summary
CVE-2020-2250: Passwords stored in plain text by Jenkins ReadyAPI Functional Testing Plugin. Affects org.jenkins-ci.plugins:soapui-pro-functional-testing versions < 1.4. Fixed in 1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins ReadyAPI Functional Testing Plugin is a Maven package (org.jenkins-ci.plugins:soapui-pro-functional-testing) that provides functionality for functional testing in Jenkins. It allows users to define and execute tests for SOAP and REST APIs. The plugin is widely used in software development and continuous integration workflows.
Vulnerability Detail
The plugin version 1.3 and earlier stores project passwords in plain text in the job config.xml files. This means that sensitive information, such as passwords, are not properly encrypted and can be easily accessed by attackers with Extended Read permission or access to the Jenkins controller file system. The vulnerability has a CVSS score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The impact of this vulnerability is moderate, as it can lead to unauthorized access to sensitive information and potential misuse of credentials.
How To Fix
Latest published version: 1.14 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to upgrade to the fixed version of the plugin.
Conclusion
The Jenkins ReadyAPI Functional Testing Plugin version 1.3 and earlier is vulnerable to storing passwords in plain text, which can be accessed by attackers with certain permissions or file system access. To mitigate this vulnerability, users should upgrade to version 1.4 of the plugin and re-save any affected job configurations. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:soapui-pro-functional-testing →
FAQ
The vulnerability allows attackers with certain permissions or access to the Jenkins controller file system to view project passwords stored in plain text. This can lead to unauthorized access to sensitive information and potential misuse of credentials.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are found.
Yes, the fix for this vulnerability is available in version 1.4 of the ReadyAPI Functional Testing Plugin. It is recommended to upgrade to this version to ensure that project passwords are properly encrypted.
No specific workarounds are provided for this vulnerability. The recommended solution is to upgrade to the fixed version of the plugin.
The severity of this vulnerability is moderate, with a CVSS score of 4.3. While it can lead to unauthorized access to sensitive information, it does not have a high likelihood of exploitation or significant impact on the system.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:soapui-pro-functional-testing.
