GitHub Advisoryadvisory · Maven

GHSA-3x9h-3p7m-33m7 Jenkins SonarQube Plugin Stores Passwords in Cleartext

MEDIUM Published 2022-05-17 Modified 2025-03-13 Official page ↗
Aliases
CVE-2013-5676
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:sonar
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-312
Reviewed
2025-03-13

Affected packages

• Maven org.jenkins-ci.plugins:sonar: <= 3.7 (no fix yet)

Description

The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.

Related

Alias · CVE (1)

  • CVE-2013-5676 The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by… vulnerability

Weakness · CWE (1)

  • CWE-312 Cleartext Storage of Sensitive Information weakness

References