CVE-2013-5676
Jenkins SonarQube Plugin Stores Passwords in Cleartext
Résumé
Jenkins SonarQube Plugin Stores Passwords in Cleartext
Description d'origine
La description telle que publiée par la source (souvent en anglais).
The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Maven
org.jenkins-ci.plugins:sonar
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.7"}]}]
Références
- advisory nvd.nist.gov
- package github.com
- web seclists.org