Description
Jenkins SoapUI Pro Functional Testing Plugin 1.3 and earlier stores project passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by attackers with Extended Read permission, or access to the Jenkins controller file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2020/09/01/3
https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1631%20%281%29
Related Vulnerabilities
CVE-2022-23496 Vulnerability in maven package nl.basjes.parse.useragent:yauaa-beam-sql
CVE-2022-41946 Vulnerability in maven package org.postgresql:postgresql
CVE-2020-27216 Vulnerability in maven package jetty:jetty
CVE-2019-10280 Vulnerability in maven package org.jenkins-ci.plugins:assembla-auth
CVE-2018-14721 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind