PT-2013-5722 · Jenkins · Jenkins Plugin For Sonarqube

Christian Catalano + 1 · Published 2013-12-13 · Updated 2022-05-17 · CVE-2013-5676

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Jenkins Plugin for SonarQube versions 3.7 and earlier

Description The issue allows remote authenticated users to obtain sensitive information, specifically cleartext passwords, by reading the value in the sonarPassword parameter from the jenkins/configure page.

Recommendations For Jenkins Plugin for SonarQube versions 3.7 and earlier, consider restricting access to the jenkins/configure page to minimize the risk of exploitation. Avoid using the sonarPassword parameter in the affected configuration until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

CWE-310

Related Identifiers

CVE-2013-5676

GHSA-3X9H-3P7M-33M7

Affected Products

Jenkins Plugin For Sonarqube

References · 6

• 🔥 https://exploit-db.com/exploits/30409 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-5676 · Security Note
• https://osv.dev/vulnerability/GHSA-3x9h-3p7m-33m7 · Vendor Advisory
• https://github.com/jenkinsci/sonarqube-plugin · Note
• http://osvdb.org/100666 · Note
• http://seclists.org/fulldisclosure/2013/Dec/37 · Note