~ / search / GHSA-8mjp-8c2x-3g7w

GHSA-8mjp-8c2x-3g7w

Jenkins QMetry for JIRA Plugin stored credentials in plain text

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-16544

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:qmetry-for-jira-test-management < 1.13 1.13

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins QMetry for JIRA - Test Management Plugin stored credentials unencrypted in job config.xml files on the Jenkins controller as part of its post-build step configuration. This credential could be viewed by users with Extended Read permission or access to the Jenkins controller file system. QMetry for JIRA - Test Management Plugin now stores these credentials encrypted once the job configuration is saved again.

References

External links from the advisory. They lead to third-party sites.