Skip to content
OpenAdvisories

Package · Maven

org.jenkins-ci.plugins:sonar

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.8
    CVE-2018-1000425

    Jenkins SonarQube Scanner Plugin stored server authentication token in plain text

    An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attackers with local file system access to obtain the credentials used to connect to SonarQube.

    org.jenkins-ci.plugins:sonar Maven
  • Medium —
    CVE-2013-5676 Public exploit

    Jenkins SonarQube Plugin Stores Passwords in Cleartext

    The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.

    org.jenkins-ci.plugins:sonar Maven