PT-2019-14700 · Jenkins · Jenkins Qmetry For Jira - Test Management Plugin

Published 2019-11-21 · Updated 2023-10-25 · CVE-2019-16545

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins QMetry for JIRA - Test Management Plugin versions prior to 1.13

Description The issue concerns the transmission of credentials in plain text as part of job configuration forms, potentially leading to their exposure. Although the password is stored encrypted on disk since version 1.13, it is still transmitted in plain text as part of the configuration form. This can result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations.

Recommendations For versions prior to 1.13, consider updating to version 1.13 or later to ensure that passwords are stored encrypted on disk. As a temporary workaround, restrict access to the configuration form to minimize the risk of exposure. Avoid using the plugin's post-build step configuration until the issue is resolved.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2019-16545

GHSA-793W-Q2H5-8H5J

Affected Products

Jenkins Qmetry For Jira - Test Management Plugin

References · 7

• https://osv.dev/vulnerability/GHSA-793w-q2h5-8h5j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16545 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16545 · Vendor Advisory
• https://github.com/jenkinsci/qmetry-for-jira-test-management-plugin/commit/6711f566b72c099f10b1cecab406786ca998651d · Note
• https://jenkins.io/security/advisory/2019-11-21/#SECURITY-727%20%282%29 · Note
• http://openwall.com/lists/oss-security/2019/11/21/1 · Note
• https://jenkins.io/security/advisory/2019-11-21/#SECURITY-727%20(2) · Note