Credentials stored in plain text by Zephyr Enterprise Test Management Plugin
Low severity
GitHub Reviewed
Published
May 24, 2022
to the GitHub Advisory Database
•
Updated Oct 26, 2023
Package
Affected versions
< 1.10
Patched versions
1.10
Description
Published by the National Vulnerability Database
Mar 9, 2020
Published to the GitHub Advisory Database
May 24, 2022
Reviewed
Jan 14, 2023
Last updated
Oct 26, 2023
Credits
-
NotMyFault Analyst
Zephyr Enterprise Test Management Plugin 1.9.1 and earlier stores its Zephyr password in plain text in the global configuration file
com.thed.zephyr.jenkins.reporter.ZeeReporter.xml. This password can be viewed by users with access to the Jenkins controller file system.Zephyr Enterprise Test Management Plugin 1.10 integrates with Credentials Plugin.
References