Password stored in plain text by Parasoft Environment Manager Plugin

2022-05-2417:08:47

Google

osv.dev

0.001 Low

EPSS

Percentile

28.6%

JSON

Jenkins Parasoft Environment Manager Plugin 2.14 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.

CPENameOperatorVersion
com.parasoft:environment-managereq2.9
com.parasoft:environment-managereq2.10
com.parasoft:environment-managereq2.6
com.parasoft:environment-managereq2.11
com.parasoft:environment-managereq2.3
com.parasoft:environment-managereq2.2
com.parasoft:environment-managereq2.8
com.parasoft:environment-managereq2.12
com.parasoft:environment-managereq2.14
com.parasoft:environment-managereq2.13

Name	Operator	Version
com.parasoft:environment-manager	eq	2.9
com.parasoft:environment-manager	eq	2.10
com.parasoft:environment-manager	eq	2.6
com.parasoft:environment-manager	eq	2.11
com.parasoft:environment-manager	eq	2.3
com.parasoft:environment-manager	eq	2.2
com.parasoft:environment-manager	eq	2.8
com.parasoft:environment-manager	eq	2.12
com.parasoft:environment-manager	eq	2.14
com.parasoft:environment-manager	eq	2.13