CVE-2021-21614: Credentials stored in plain text by Jenkins Bumblebee HP ALM Plugin
Summary
CVE-2021-21614: Credentials stored in plain text by Jenkins Bumblebee HP ALM Plugin. Affects org.jenkins-ci.plugins:bumblebee versions < 4.1.6. Fixed in 4.1.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Bumblebee HP ALM Plugin is a Maven package that provides integration between Jenkins and HP ALM (Application Lifecycle Management). It allows users to execute HP ALM tests from Jenkins and view the test results. The plugin stores its global configuration in the file 'com.agiletestware.bumblebee.BumblebeeGlobalConfig.xml' on the Jenkins controller. This configuration file contains credentials used for authentication with HP ALM. Prior to version 4.1.6, the plugin stored these credentials in plain text, making them vulnerable to unauthorized access.
Vulnerability Detail
The vulnerability in the Bumblebee HP ALM Plugin allows users with access to the Jenkins controller file system to view the stored credentials in plain text. This means that any user with file system access can potentially obtain sensitive information, such as usernames and passwords, used for authentication with HP ALM. The impact of this vulnerability depends on the level of access granted to the compromised credentials. If the credentials provide administrative privileges, an attacker could potentially gain control over the HP ALM system and perform unauthorized actions.
How To Fix
Minimum fixed version
4.1.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update to the latest version of the Bumblebee HP ALM Plugin.
Conclusion
The Bumblebee HP ALM Plugin prior to version 4.1.6 stores credentials in plain text, making them vulnerable to unauthorized access. To mitigate this vulnerability, it is crucial to update the plugin to version 4.1.6 or later, which encrypts the stored credentials. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:bumblebee →
FAQ
The Bumblebee HP ALM Plugin is a Jenkins plugin that enables integration between Jenkins and HP ALM, allowing users to execute HP ALM tests from Jenkins and view the test results.
The vulnerability allows users with file system access to view the stored credentials in plain text. This can lead to unauthorized access to sensitive information, potentially compromising the security of the HP ALM system.
To fix this vulnerability, update the Bumblebee HP ALM Plugin to version 4.1.6 or later, which encrypts the stored credentials.
There are no specific workarounds mentioned for this vulnerability. Updating to the latest version of the plugin is the recommended solution.
Yes, if you don't update the plugin, the stored credentials will remain vulnerable to unauthorized access. This can potentially lead to unauthorized actions being performed on the HP ALM system.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:bumblebee.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
