CVE-2013-5676
Jenkins SonarQube Plugin Stores Passwords in Cleartext
Summary
Jenkins SonarQube Plugin Stores Passwords in Cleartext
Original description
The description as published by the source.
The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Maven
org.jenkins-ci.plugins:sonar
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.7"}]}]
References
- advisory nvd.nist.gov
- package github.com
- web seclists.org