CWE-256
AllowedPlaintext Storage of a Password
Abstraction: Base · Status: Incomplete
The product stores a password in plaintext within resources such as memory or files.
411 vulnerabilities reference this CWE, most recent first.
GHSA-XV58-GP43-6M76
Vulnerability from github – Published: 2022-05-24 17:10 – Updated: 2023-01-14 05:23Zephyr Enterprise Test Management Plugin 1.9.1 and earlier stores its Zephyr password in plain text in the global configuration file com.thed.zephyr.jenkins.reporter.ZeeReporter.xml. This password can be viewed by users with access to the Jenkins controller file system.
Zephyr Enterprise Test Management Plugin 1.10 integrates with Credentials Plugin.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:zephyr-enterprise-test-management"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-2145"
],
"database_specific": {
"cwe_ids": [
"CWE-256",
"CWE-522"
],
"github_reviewed": true,
"github_reviewed_at": "2023-01-14T05:23:40Z",
"nvd_published_at": "2020-03-09T16:15:00Z",
"severity": "LOW"
},
"details": "Zephyr Enterprise Test Management Plugin 1.9.1 and earlier stores its Zephyr password in plain text in the global configuration file `com.thed.zephyr.jenkins.reporter.ZeeReporter.xml`. This password can be viewed by users with access to the Jenkins controller file system.\n\nZephyr Enterprise Test Management Plugin 1.10 integrates with [Credentials Plugin](https://plugins.jenkins.io/credentials).",
"id": "GHSA-xv58-gp43-6m76",
"modified": "2023-01-14T05:23:40Z",
"published": "2022-05-24T17:10:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2145"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1596"
},
{
"type": "PACKAGE",
"url": "https://plugins.jenkins.io/zephyr-enterprise-test-management"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/03/09/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Credentials stored in plain text by Zephyr Enterprise Test Management Plugin"
}
Mitigation
Avoid storing passwords in easily accessible locations.
Mitigation
Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.
Mitigation
A programmer might attempt to remedy the password management problem by obscuring the password with an encoding function, such as base 64 encoding, but this effort does not adequately protect the password because the encoding can be detected and decoded easily.
No CAPEC attack patterns related to this CWE.