GitHub Advisoryadvisory · Maven

GHSA-2x3g-rr4w-4qrp Jenkins Zoho QEngine Plugin Displays Unmasked API Keys

LOW Published 2025-03-19 Modified 2025-03-21 Official page ↗
Aliases
CVE-2025-30197
Ecosystem
Maven
Packages
io.jenkins.plugins:zohoqengine
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-522, CWE-549
Reviewed
2025-03-20

Affected packages

• Maven io.jenkins.plugins:zohoqengine: < 1.0.31.v4a_b_1db_6d6a_f2 → fixed in 1.0.31.v4a_b_1db_6d6a_f2

Description

Jenkins Zoho QEngine Plugin 1.0.29.vfa_cc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for attackers to observe and capture it.

Related

Alias · CVE (1)

  • CVE-2025-30197 Jenkins Zoho QEngine Plugin 1.0.29.vfa_cc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for… vulnerability

Weakness · CWE (2)

  • CWE-522 Insufficiently Protected Credentials weakness
  • CWE-549 Missing Password Field Masking weakness

References