Vulnerabilities > CVE-2013-5676 - Cryptographic Issues vulnerability in Sonarsource Jenkins Plugin

CVSS 4.0 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

SINGLE

Confidentiality impact

PARTIAL

Integrity impact

NONE

Availability impact

NONE

network

low complexity

sonarsource

CWE-310

exploit available

NVD

Published: 2013-12-13

Updated: 2013-12-16

Summary

The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.

Vulnerable Configurations

Part	Description	Count
Application	Sonarsource Sonarsource Jenkins Plugin - Sonarsource Sonarqube *	2

Common Weakness Enumeration (CWE)

CWE-310 - Cryptographic Issues

Common Attack Pattern Enumeration and Classification (CAPEC)

Signature Spoofing by Key Recreation
An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.

Exploit-Db

description	SonarQube Jenkins Plugin - Plain Text Password. CVE-2013-5676. Webapps exploit for php platform
id	EDB-ID:30409
last seen	2016-02-03
modified	2013-12-18
published	2013-12-18
reporter	Christian Catalano
source	https://www.exploit-db.com/download/30409/
title	SonarQube Jenkins Plugin - Plain Text Password

Packetstorm

data source	https://packetstormsecurity.com/files/download/138333/sonarqube-disclose.txt
id	PACKETSTORM:138333
last seen	2016-12-05
published	2016-08-13
reporter	Christian Catalano
source	https://packetstormsecurity.com/files/138333/SonarQube-Jenkins-Password-Disclosure.html
title	SonarQube Jenkins Password Disclosure

Seebug

bulletinFamily	exploit
description	No description provided by source.
id	SSV:83804
last seen	2017-11-19
modified	2014-07-01
published	2014-07-01
reporter	Root
source	https://www.seebug.org/vuldb/ssvid-83804
title	SonarQube Jenkins Plugin - Plain Text Password