SonarQube Jenkins Password Disclosure

Advisory Information Title: SonarQube Jenkins Plugin - Plain Text Password Date published: 2013-12-05 Date of last update: 2013-12-05 Vendors contacted : SonarQube and Jenkins CI Discovered by: Christian Catalano Severity: High 2. Vulnerability Information CVE reference: CVE-2013-5676 CVSS v2...

CVE-2013-5676

The CVE-2013-5676 entry affects the Jenkins SonarQube Plugin (version 3.7 and earlier). The vulnerability allows remote authenticated users to obtain sensitive information by reading the sonarPassword parameter from jenkins/configure, exposing cleartext passwords. The available connected document...