~ / search / GHSA-3x9h-3p7m-33m7

GHSA-3x9h-3p7m-33m7

Jenkins SonarQube Plugin Stores Passwords in Cleartext

Source: GitHub Advisory Database (reviewed) Moderate CVE-2013-5676

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:sonar <= 3.7 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.

References

External links from the advisory. They lead to third-party sites.