CVE-2020-2250: Medium severity soapui pro functional testing vulnerability
Jenkins SoapUI Pro Functional Testing Plugin 1.3 and earlier stores project passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by attackers with Extended Read permission, or access to the Jenkins controller file system.
Other sources
ReadyAPI Functional Testing Plugin 1.3 and earlier stores project passwords unencrypted in job config.xml files as part of its configuration. These project passwords can be viewed by attackers with Extended Read permission or access to the Jenkins controller file system.
ReadyAPI Functional Testing Plugin 1.4 stores project passwords encrypted once affected job configurations are saved again.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-2250.
What is the severity of CVE-2020-2250?
The severity of CVE-2020-2250 is medium with a CVSS score of 6.5.
What is the affected software for CVE-2020-2250?
The affected software for CVE-2020-2250 is Jenkins SoapUI Pro Functional Testing Plugin 1.3 and earlier.
How are project passwords stored in Jenkins SoapUI Pro Functional Testing Plugin 1.3 and earlier?
Project passwords are stored unencrypted in job config.xml files as part of the plugin's configuration.
Who can view the project passwords in Jenkins SoapUI Pro Functional Testing Plugin 1.3 and earlier?
Attackers with Extended Read permission or access to the Jenkins controller file system can view the project passwords.