Cleartext storage of sensitive information in Codebeamer Test Results Trend Updater - #VU18073
Published: March 25, 2019
Vulnerability identifier: #VU18073
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-312
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The disclosed vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to application stores username and password in its configuration unencrypted in jobs' config.xml files on the Jenkins master.. A local user with with Extended Read permission or access to the master filesystem can obtain the password.
Affected software
Codebeamer Test Results Trend Updater
Remediation
Install updates from vendor's website.
Codebeamer Test Results Trend Updater - update to 1.1.1