Jenkins SOASTA CloudTest Plugin stores API token in plain text

2022-05-2416:58:50

Google

osv.dev

6.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.2%

JSON

Jenkins SOASTA CloudTest Plugin stores credentials unencrypted in its global configuration file com.soasta.jenkins.CloudTestServer.xml on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system.

As of publication of this advisory there is no fix.

CPENameOperatorVersion
com.soasta.jenkins:cloudtesteq2.18
com.soasta.jenkins:cloudtesteq2.20
com.soasta.jenkins:cloudtesteq2.3
com.soasta.jenkins:cloudtesteq2.25
com.soasta.jenkins:cloudtesteq2.24
com.soasta.jenkins:cloudtesteq2.16
com.soasta.jenkins:cloudtesteq2.17
com.soasta.jenkins:cloudtesteq2.23
com.soasta.jenkins:cloudtesteq2.12
com.soasta.jenkins:cloudtesteq2.19

Name	Operator	Version
com.soasta.jenkins:cloudtest	eq	2.18
com.soasta.jenkins:cloudtest	eq	2.20
com.soasta.jenkins:cloudtest	eq	2.3
com.soasta.jenkins:cloudtest	eq	2.25
com.soasta.jenkins:cloudtest	eq	2.24
com.soasta.jenkins:cloudtest	eq	2.16
com.soasta.jenkins:cloudtest	eq	2.17
com.soasta.jenkins:cloudtest	eq	2.23
com.soasta.jenkins:cloudtest	eq	2.12
com.soasta.jenkins:cloudtest	eq	2.19