Jenkins PRQA Plugin stored password in plain text

2022-05-1301:15:11

Google

osv.dev

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Jenkins PRQA Plugin stored a password unencrypted in its global configuration file on the Jenkins controller. This password could be viewed by users with access to the Jenkins controller file system.

The plugin now stores the password encrypted in the configuration files on disk.

CPENameOperatorVersion
com.programmingresearch:prqa-plugineq2.0.9
com.programmingresearch:prqa-plugineq3.0.0
com.programmingresearch:prqa-plugineq2.0.11
com.programmingresearch:prqa-plugineq3.1.0
com.programmingresearch:prqa-plugineq3.0.1
com.programmingresearch:prqa-plugineq2.1.0
com.programmingresearch:prqa-plugineq2.0.12

Name	Operator	Version
com.programmingresearch:prqa-plugin	eq	2.0.9
com.programmingresearch:prqa-plugin	eq	3.0.0
com.programmingresearch:prqa-plugin	eq	2.0.11
com.programmingresearch:prqa-plugin	eq	3.1.0
com.programmingresearch:prqa-plugin	eq	3.0.1
com.programmingresearch:prqa-plugin	eq	2.1.0
com.programmingresearch:prqa-plugin	eq	2.0.12