PT-2019-14699 · Jenkins · Jenkins Qmetry For Jira - Test Management Plugin

Published 2019-11-21 · Updated 2023-10-25 · CVE-2019-16544

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins QMetry for JIRA - Test Management Plugin versions 1.12 and earlier

Description The issue concerns the storage of credentials in an unencrypted manner in job config.xml files on the Jenkins master or controller. This allows users with Extended Read permission or access to the master or controller file system to view these credentials. The problem arises as part of the post-build step configuration.

Recommendations For Jenkins QMetry for JIRA - Test Management Plugin versions 1.12 and earlier, reconfigure the job to save the credentials encrypted by resaving the job configuration.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2019-16544

GHSA-8MJP-8C2X-3G7W

Affected Products

Jenkins Qmetry For Jira - Test Management Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-16544 · Security Note
• https://osv.dev/vulnerability/GHSA-8mjp-8c2x-3g7w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-16544 · Vendor Advisory
• https://jenkins.io/security/advisory/2019-11-21/#SECURITY-727%20(1) · Note
• http://openwall.com/lists/oss-security/2019/11/21/1 · Note
• https://jenkins.io/security/advisory/2019-11-21/#SECURITY-727%20%281%29 · Note