CVE-2020-2251
First published: Tue Sep 01 2020(Updated: )
Jenkins SoapUI Pro Functional Testing Plugin 1.5 and earlier transmits project passwords in its configuration in plain text as part of job configuration forms, potentially resulting in their exposure.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Jenkins | <2.236 | |
| Jenkins Soapui Pro Functional Testing | <=1.5 | |
| maven/org.jenkins-ci.plugins:soapui-pro-functional-testing | <=1.5 | 1.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2020/09/01/3
- https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1631%20(2)
- https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1631%20%282%29
- https://nvd.nist.gov/vuln/detail/CVE-2020-2251
- https://github.com/advisories/GHSA-q4qq-8q2r-g2f2 (Advisory)
Frequently Asked Questions
What is CVE-2020-2251?
CVE-2020-2251 is a vulnerability found in Jenkins SoapUI Pro Functional Testing Plugin 1.5 and earlier versions, where project passwords are transmitted in plain text as part of the global configuration.
How severe is CVE-2020-2251?
CVE-2020-2251 has a severity rating of 4.3, which is considered medium.
What software is affected by CVE-2020-2251?
Jenkins Jenkins 2.236, Jenkins Soapui Pro Functional Testing Plugin up to version 1.5, and org.jenkins-ci.plugins:soapui-pro-functional-testing up to version 1.5 are affected by CVE-2020-2251.
How are project passwords stored in Jenkins SoapUI Pro Functional Testing Plugin?
Project passwords are stored in job `config.xml` files on the Jenkins controller as part of the plugin's configuration.
How can I fix CVE-2020-2251?
To fix CVE-2020-2251, upgrade to ReadyAPI Functional Testing Plugin version 1.6 or later.
- collector/nvd-index
- collector/nvd-api
- collector/github-advisory-latest
- alias/GHSA-q4qq-8q2r-g2f2
- alias/CVE-2020-2251
- collector/github-advisory
- collector/nvd-cve
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/author
- agent/weakness
- agent/last-modified-date
- agent/tags
- agent/event
- agent/description
- agent/first-publish-date
- agent/trending
- vendor/jenkins
- canonical/jenkins jenkins
- canonical/jenkins soapui pro functional testing
- version/jenkins soapui pro functional testing/1.5
- package-manager/maven