GitHub Advisoryadvisory · Maven

GHSA-8mjp-8c2x-3g7w Jenkins QMetry for JIRA Plugin stored credentials in plain text

MEDIUM Published 2022-05-24 Modified 2023-10-27 Official page ↗
Aliases
CVE-2019-16544
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:qmetry-for-jira-test-management
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-522
Reviewed
2023-10-27

Affected packages

• Maven org.jenkins-ci.plugins:qmetry-for-jira-test-management: < 1.13 → fixed in 1.13

Description

Jenkins QMetry for JIRA - Test Management Plugin stored credentials unencrypted in job config.xml files on the Jenkins controller as part of its post-build step configuration. This credential could be viewed by users with Extended Read permission or access to the Jenkins controller file system. QMetry for JIRA - Test Management Plugin now stores these credentials encrypted once the job configuration is saved again.

Related

Alias · CVE (1)

  • CVE-2019-16544 Jenkins QMetry for JIRA - Test Management Plugin 1.12 and earlier stores credentials unencrypted in job config.xml files on the Jenkins… vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References