medium4.3
CVE-2019-10451
Jenkins SOASTA CloudTest Plugin stores API token in plain text
Impact
Jenkins SOASTA CloudTest Plugin stores credentials unencrypted in its global configuration file `com.soasta.jenkins.CloudTestServer.xml` on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system. As of publication of this advisory there is no fix.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.soasta.jenkins:cloudtest | <= 2.25 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Soasta Cloudtest | through 2.25 |