CVE-2019-16545 Jenkins QMetry for JIRA Plugin shows plain text password in configuration form
The Jenkins QMetry plugin exposes credentials in plain text within job configurations, allowing attackers to read sensitive authentication data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-16545?
CVE-2019-16545 is a medium-severity vulnerability in Jenkins QMetry for JIRA - Test Management Plugin, published on 21 Nov 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Jenkins QMetry for JIRA - Test Management Plugin transmits credentials in its configuration in plain text as part of job configuration forms, potentially resulting in their exposure.
Weakness: CWE-319
Which versions are affected by CVE-2019-16545?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:qmetry-for-jira-test-management. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:qmetry-for-jira-test-management Maven | All versions | 1.14.0 |
org.jenkins-ci.plugins:qmetry-for-jira-test-management Maven | All versions | 1.14.0 |
Products include Qmetry Jenkins Qmetry for Jira.
How do I fix CVE-2019-16545?
Upgrade org.jenkins-ci.plugins:qmetry-for-jira-test-management to 1.14.0 or later.
Is CVE-2019-16545 being exploited?
There is no known exploitation of CVE-2019-16545 in the wild and no public exploit code.
Other vulnerabilities in Jenkins QMetry for JIRA - Test Management Plugin
Sources
Also known as GHSA-793w-q2h5-8h5j.