Not rated

CVE-2020-2209 Jenkins TestComplete support Plugin 2.4.1 and earlier stores a password unencrypted in job config.xml files on the…

Description

Jenkins TestComplete support Plugin 2.4.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins TestComplete support Plugin 2.4	earliest → 2.4.1	No fix stated

References

jenkins.io jenkins.io
[oss-security] 20200702 Multiple vulnerabilities in Jenkins plugins www.openwall.com

Timeline

Published July 2, 2020
Last modified August 4, 2024

The 3 CVEs of Jenkins TestComplete support Plugin →

CVE-2023-33002 Jenkins TestComplete support Plugin 2.8.1 and earlier does not escape the TestComplete project name, resulting in a… 5.4 Medium CVE-2023-24443 Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity… 9.8 Critical

Track this CVE

CVE-2020-2209 Jenkins TestComplete support Plugin 2.4.1 and earlier stores a password unencrypted in job config.xml files on the…

Description

Affected products and versions

References

Timeline

Other CVEs of Jenkins TestComplete support Plugin