GHSA-2x3g-rr4w-4qrp

Jenkins Zoho QEngine Plugin Displays Unmasked API Keys

Source: GitHub Advisory Database (reviewed) Low CVE-2025-30197

Packages

Ecosystem	Package	Affected	Fixed in
Maven	io.jenkins.plugins:zohoqengine	< 1.0.31.v4a_b_1db_6d6a_f2	1.0.31.v4a_b_1db_6d6a_f2

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Zoho QEngine Plugin 1.0.29.vfa_cc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for attackers to observe and capture it.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-30197 advisory
https://github.com/jenkinsci/zohoqengine-plugin/commit/4ab1db6d6af21f43dd15cc328599445519875fa8 web
https://github.com/jenkinsci/zohoqengine-plugin package
https://www.jenkins.io/security/advisory/2025-03-19/#SECURITY-3511 web