Password stored in plain text by Jenkins TestComplete support Plugin

中危 4.3CVE-2020-2209 · GHSA-r32r-f6wr-cc3w · Published 02/07/2020 · updated 17/06/2026

要点

CVE-2020-2209 是影响 org.jenkins-ci.plugins:TestComplete, testcomplete support (jenkins) 的中危 (CVSS 4.3)漏洞。
未来 30 天内被利用的概率（EPSS）：0.69%，高于 52.9% 的漏洞。
修复：升级到 2.5.2 或更高版本。

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:TestComplete Maven	`< 2.5.2`	`2.5.2`
testcomplete support jenkins	`≤ 2.4.1`	No fix yet

Description

Jenkins TestComplete support Plugin prior to version 2.5.2 stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system. Version 2.5.2 contains a patch for this issue.

NVD description

Jenkins TestComplete support Plugin 2.4.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.

References

nvd.nist.gov/vuln/detail/CVE-2020-2209 · ADVISORY
jenkinsci/testcomplete-plugin commit 0098887 · WEB
jenkinsci/testcomplete-plugin commit 91dae11 · WEB
jenkinsci/testcomplete-plugin commit ca783d3 · WEB
jenkinsci/testcomplete-plugin · PACKAGE
jenkins.io/security/advisory/2020-07-02 · WEB
openwall.com/lists/oss-security/2020/07/02/7 · WEB

org.jenkins-ci.plugins:TestComplete 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:TestComplete

Maven

< 2.5.2

2.5.2

testcomplete support

jenkins

≤ 2.4.1

No fix yet

Description

NVD description

org.jenkins-ci.plugins:TestComplete 的其他漏洞

查看全部 →