GitHub Advisoryadvisory · Maven

GHSA-793w-q2h5-8h5j Jenkins QMetry for JIRA Plugin shows plain text password in configuration form

LOW Published 2022-05-24 Modified 2023-10-27 Official page ↗
Aliases
CVE-2019-16545
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:qmetry-for-jira-test-management
Severity
Low
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-319
Reviewed
2023-10-27

Affected packages

• Maven org.jenkins-ci.plugins:qmetry-for-jira-test-management: < 1.14.0 → fixed in 1.14.0

Description

Jenkins QMetry for JIRA - Test Management Plugin stores a credential as part of its post-build step configuration. While the password is stored encrypted on disk since QMetry for JIRA - Test Management Plugin 1.13, it is transmitted in plain text as part of the configuration form. This can result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations.

Related

Alias · CVE (1)

  • CVE-2019-16545 Jenkins QMetry for JIRA - Test Management Plugin transmits credentials in its configuration in plain text as part of job configuration… vulnerability

Weakness · CWE (1)

  • CWE-319 Cleartext Transmission of Sensitive Information weakness

References