GitHub Advisoryadvisory · Maven

GHSA-mxmw-6qgj-h67x Jenkins PRQA Plugin stored password in plain text

LOW Published 2022-05-13 Modified 2023-10-26 Official page ↗
Aliases
CVE-2019-1003048
Ecosystem
Maven
Packages
com.programmingresearch:prqa-plugin
Severity
Low
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-311
Reviewed
2023-10-26

Affected packages

• Maven com.programmingresearch:prqa-plugin: < 3.1.2 → fixed in 3.1.2

Description

Jenkins PRQA Plugin stored a password unencrypted in its global configuration file on the Jenkins controller. This password could be viewed by users with access to the Jenkins controller file system. The plugin now stores the password encrypted in the configuration files on disk.

Related

Alias · CVE (1)

  • CVE-2019-1003048 A vulnerability in Jenkins PRQA Plugin 3.1.0 and earlier allows attackers with local file system access to the Jenkins home directory to… vulnerability

Weakness · CWE (1)

  • CWE-311 Missing Encryption of Sensitive Data weakness

References