-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:soapui-pro-functional-testing | maven | <= 1.11 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the com.smartbear.ready.jenkins.JenkinsSoapUIProTestRunner class, which is a Jenkins build step. This class stores sensitive credentials such as passwords, access keys, and client secrets in plain String fields instead of using the hudson.util.Secret class provided by Jenkins for this purpose. The data-bound setter methods (@DataBoundSetter) for these fields take the credentials as plain strings from the job configuration form and assign them to these insecure fields. As a result, when a user configures a job using the 'ReadyAPI Test: Run Functional Test' build step, these credentials are serialized and stored in plaintext within the job's config.xml file on the Jenkins controller. This exposes the credentials to anyone with read access to the job configuration or file system access to the Jenkins controller. The lack of masking for these fields in the UI further increases the risk of shoulder-surfing attacks.