GHSA-mxmw-6qgj-h67x

Jenkins PRQA Plugin stored password in plain text

Source: GitHub Advisory Database (reviewed) Low CVE-2019-1003048

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.programmingresearch:prqa-plugin	< 3.1.2	3.1.2

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins PRQA Plugin stored a password unencrypted in its global configuration file on the Jenkins controller. This password could be viewed by users with access to the Jenkins controller file system. The plugin now stores the password encrypted in the configuration files on disk.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-1003048 advisory
https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1089 web
https://web.archive.org/web/20200227082607/http://www.securityfocus.com/bid/107628 web
http://www.openwall.com/lists/oss-security/2019/03/28/2 web