Cleartext storage of sensitive information in Jenkins Zephyr for JIRA Test Management Plugin



Published: 2020-03-12 | Updated: 2020-07-03
Risk Medium
Patch available NO
Number of vulnerabilities 3
CVE-ID CVE-2020-2154
CVE-2020-2216
CVE-2020-2215
CWE-ID CWE-312
CWE-264
CWE-352
Exploitation vector Network
Public exploit Public exploit code for vulnerability #2 is available.
Public exploit code for vulnerability #3 is available.
Vulnerable software
Subscribe 		Zephyr for JIRA Test Management
Web applications / Modules and components for CMS

Vendor Jenkins

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

Updated 03.07.2020

Added vulnerabilities #2-3, severity changed to Medium.

1) Cleartext storage of sensitive information

EUVDB-ID: #VU26040

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2020-2154

CWE-ID: CWE-312 - Cleartext Storage of Sensitive Information

Exploit availability: No

Description

The vulnerability allows a local user to view the password on the target system.

The vulnerability exists due to the affected software stores Jira credentials unencrypted in its global configuration file "com.thed.zephyr.jenkins.reporter.ZfjReporter.xml" on the Jenkins master. A local user with access to the master file system can obtain this credential.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Zephyr for JIRA Test Management: 1.5

CPE2.3 External links

http://www.openwall.com/lists/oss-security/2020/03/09/1
http://jenkins.io/security/advisory/2020-03-09/#SECURITY-1550


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU29526

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2020-2216

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to the affected plugin does not perform a permission check in a method implementing form validation. A remote user with Overall/Read access can connect to an attacker-specified host using attacker-specified username and password.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Zephyr for JIRA Test Management: 1.5

CPE2.3 External links

http://www.openwall.com/lists/oss-security/2020/07/02/7
http://jenkins.io/security/advisory/2020-07-02/#SECURITY-1762


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

3) Cross-site request forgery

EUVDB-ID: #VU29525

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2020-2215

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to the affected plugin does not require POST requests. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Zephyr for JIRA Test Management: 1.5

CPE2.3 External links

http://www.openwall.com/lists/oss-security/2020/07/02/7
http://jenkins.io/security/advisory/2020-07-02/#SECURITY-1762


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###