Description
Jenkins Zephyr Enterprise Test Management Plugin 1.9.1 and earlier stores its Zephyr password in plain text on the Jenkins master file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2020/03/09/1
https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1596
Related Vulnerabilities
CVE-2020-2249 Vulnerability in maven package org.jenkins-ci.plugins:tfs
CVE-2019-10476 Vulnerability in maven package org.jenkins-ci.plugins:zulip
CVE-2019-9142 Vulnerability in maven package org.b3log:symphony
CVE-2020-28278 Vulnerability in npm package shvl
CVE-2021-35515 Vulnerability in maven package org.apache.commons:commons-compress