PT-2019-11338 · Jenkins · Jenkins Rqm Plugin+1

Viktor Gazdag · Published 2019-03-28 · Updated 2023-10-25 · CVE-2019-1003048

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Jenkins PRQA Plugin versions 3.1.0 and earlier

Description: A security issue allows attackers with local file system access to the Jenkins home directory to obtain an unencrypted password from the plugin configuration. The plugin stored a password unencrypted in its global configuration file on the Jenkins controller, which could be viewed by users with access to the Jenkins controller file system. The issue has been addressed by storing the password encrypted in the configuration files on disk.

Recommendations: For Jenkins PRQA Plugin versions 3.1.0 and earlier, update the plugin to a version that stores the password encrypted in the configuration files.

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2019-1003048

GHSA-MXMW-6QGJ-H67X

Affected Products

Jenkins

Jenkins Rqm Plugin

References · 7

• https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1089 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mxmw-6qgj-h67x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1003048 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1003048 · Security Note
• https://web.archive.org/web/20200227082607/http://securityfocus.com/bid/107628 · Note
• http://securityfocus.com/bid/107628 · Note
• http://openwall.com/lists/oss-security/2019/03/28/2 · Note