Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-2274

CVE-2020-2274: Passwords stored in plain text by ElasTest Plugin

5.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-2274
GHSA ID
GHSA-p9rc-x48f-582x
EPSS Score
0.00831%
CWE
CWE-312
Published
5/24/2022
Updated
10/27/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jenkins-ci.plugins:elastestmaven<= 1.2.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability explicitly involves unencrypted password storage in ElasTestInstallation.xml. Jenkins plugins typically use setters/getters (like setServerPassword/getServerPassword) to manage configuration properties. The absence of encryption in these functions directly enables cleartext storage. While specific code isn't shown, the pattern matches Jenkins plugin security anti-patterns for credential storage, and the advisory explicitly identifies the configuration file and storage mechanism.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

J*nkins *l*sT*st Plu*in *.*.* *n* **rli*r stor*s its s*rv*r p*sswor* un*n*rypt** in its *lo**l *on*i*ur*tion *il* on t** J*nkins *ontroll*r w**r* it **n ** vi*w** *y us*rs wit* ****ss to t** J*nkins *ontroll*r *il* syst*m.

Reasoning

T** vuln*r**ility *xpli*itly involv*s un*n*rypt** p*sswor* stor*** in `*l*sT*stInst*ll*tion.xml`. J*nkins plu*ins typi**lly us* s*tt*rs/**tt*rs (lik* `s*tS*rv*rP*sswor*`/`**tS*rv*rP*sswor*`) to m*n*** *on*i*ur*tion prop*rti*s. T** **s*n** o* *n*rypti