Jenkins PRQA Plugin stored password in plain text

HIGH 7.8CVE-2019-1003048 · GHSA-mxmw-6qgj-h67x · Published 28/03/2019 · updated 17/06/2026

In short

CVE-2019-1003048 is a HIGH (CVSS 7.8) vulnerability affecting com.programmingresearch:prqa-plugin, prqa (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.30%, higher than 22.6% of all vulnerabilities.
Fix: update to 3.1.2 or later.

Package	Affected versions	Patched versions
com.programmingresearch:prqa-plugin Maven	`< 3.1.2`	`3.1.2`
prqa jenkins	`≤ 3.1.0`	No fix yet

Description

Jenkins PRQA Plugin stored a password unencrypted in its global configuration file on the Jenkins controller. This password could be viewed by users with access to the Jenkins controller file system.

The plugin now stores the password encrypted in the configuration files on disk.

NVD description

A vulnerability in Jenkins PRQA Plugin 3.1.0 and earlier allows attackers with local file system access to the Jenkins home directory to obtain the unencrypted password from the plugin configuration.

References

nvd.nist.gov/vuln/detail/CVE-2019-1003048 · ADVISORY
jenkins.io/security/advisory/2019-03-25 · WEB
web.archive.org/web/20200227082607/http://www.securityfocus.com/bid/107628 · WEB
openwall.com/lists/oss-security/2019/03/28/2 · WEB
securityfocus.com/bid/107628 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free