CVE-2022-34213: Squash TM Publisher Plugin Stores Passwords in Plain Text
Summary
CVE-2022-34213: Squash TM Publisher (Squash4Jenkins) Plugin stores passwords stored in plain text. Affects org.jenkins-ci.plugins:squashtm-publisher versions < 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Squash TM Publisher (Squash4Jenkins) Plugin is a plugin for Jenkins, an open-source automation server. It is used to integrate Squash TM, a test management tool, with Jenkins. The plugin allows users to publish test results from Jenkins to Squash TM. It provides functionality to configure the connection between Jenkins and Squash TM, including authentication credentials.
Vulnerability Detail
The Squash TM Publisher Plugin version 1.0.0 and earlier has a vulnerability where it stores passwords in plain text. These passwords are stored unencrypted in the global configuration file org.jenkinsci.squashtm.core.SquashTMPublisher.xml on the Jenkins controller. This means that any user with access to the Jenkins controller file system can view these passwords. This vulnerability poses a risk of unauthorized access to sensitive credentials, potentially leading to further security breaches or unauthorized actions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by restricting access to the Jenkins controller file system, ensuring that only authorized users have access to the sensitive configuration files. Additionally, users can consider using a different plugin or alternative methods for integrating Squash TM with Jenkins that do not store passwords in plain text.
Conclusion
The Squash TM Publisher Plugin (Squash4Jenkins) version 1.0.0 and earlier has a vulnerability that allows passwords to be stored in plain text. This can lead to unauthorized access to sensitive credentials. Users should upgrade to version 1.0.1 or later, which encrypts the stored passwords, and change any passwords that were stored in plain text. Restricting access to the Jenkins controller file system and considering alternative integration methods can also help mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:squashtm-publisher →
FAQ
This vulnerability allows unauthorized users with access to the Jenkins controller file system to view passwords stored in plain text. This can lead to unauthorized access to sensitive credentials and potential security breaches.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
Yes, the developers of the Squash TM Publisher Plugin have released a fix in version 1.0.1. It is recommended to upgrade to this version or later to address the vulnerability.
While there is no specific workaround mentioned, users can mitigate the risk by restricting access to the Jenkins controller file system and considering alternative methods for integrating Squash TM with Jenkins that do not store passwords in plain text.
If your installation is affected, it is recommended to upgrade to the fixed version of the Squash TM Publisher Plugin (1.0.1 or later) and change any passwords that were stored in plain text. You can also seek further support on vulnerability remediation by contacting info@devnack.com.
