PT-2013-5722 · Jenkins · Jenkins Plugin For Sonarqube

Christian Catalano + 1 · Publicado 2013-12-13 · Atualizado 2022-05-17 · CVE-2013-5676

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Jenkins Plugin for SonarQube versions 3.7 and earlier

Description The issue allows remote authenticated users to obtain sensitive information, specifically cleartext passwords, by reading the value in the sonarPassword parameter from the jenkins/configure page.

Recommendations For Jenkins Plugin for SonarQube versions 3.7 and earlier, consider restricting access to the jenkins/configure page to minimize the risk of exploitation. Avoid using the sonarPassword parameter in the affected configuration until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-312

CWE-310

Identificadores relacionados

CVE-2013-5676

GHSA-3X9H-3P7M-33M7

Produtos afetados

Jenkins Plugin For Sonarqube

Referências · 6

• 🔥 https://exploit-db.com/exploits/30409 · Exploit
• https://github.com/jenkinsci/sonarqube-plugin · Nota
• http://osvdb.org/100666 · Nota
• http://seclists.org/fulldisclosure/2013/Dec/37 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-5676 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-3x9h-3p7m-33m7 · Aviso do Fabricante