GitHub Advisoryadvisory · Maven

GHSA-3ccq-gccx-pm7j Jenkins SonarQube Scanner Plugin stored server authentication token in plain text

HIGH Published 2022-05-13 Modified 2024-01-30 Official page ↗
Aliases
CVE-2018-1000425
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:sonar
Severity
High
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-522
Reviewed
2024-01-30

Affected packages

• Maven org.jenkins-ci.plugins:sonar: < 2.8.1 → fixed in 2.8.1

Description

An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attackers with local file system access to obtain the credentials used to connect to SonarQube.

Related

Alias · CVE (1)

  • CVE-2018-1000425 An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java… vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References