CVE-2013-5676

The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.

Score

CVSS 2.0 4.0 Medium

Status

Modified - cve@mitre.org

Published

2013-12-13

Last modified

2024-08-06

Weaknesses

CWE-310

Affected products

• Jenkins Plugin (Sonarsource)

References

• http://seclists.org/fulldisclosure/2013/Dec/37
• http://www.osvdb.org/100666