Jenkins Zoho QEngine Plugin Displays Unmasked API Keys

BAIXO 3.1CVE-2025-30197 · GHSA-2x3g-rr4w-4qrp · Published 19/03/2025 · updated 17/06/2026

Em resumo

CVE-2025-30197 é uma vulnerabilidade BAIXO (CVSS 3.1) que afeta io.jenkins.plugins:zohoqengine, zoho qengine (jenkins).
Chance de exploração nos próximos 30 dias (EPSS): 0.28%, maior que 20.8% das vulnerabilidades.
Correção: atualize para 1.0.31.v4a_b_1db_6d6a_f2 ou posterior.

Package	Affected versions	Patched versions
io.jenkins.plugins:zohoqengine Maven	`< 1.0.31.v4a_b_1db_6d6a_f2`	`1.0.31.v4a_b_1db_6d6a_f2`
zoho qengine jenkins	`≤ 1.0.29.vfa_cc23396502`	No fix yet

Description

Jenkins Zoho QEngine Plugin 1.0.29.vfa_cc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for attackers to observe and capture it.

NVD description

Jenkins Zoho QEngine Plugin 1.0.29.vfa_cc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for attackers to observe and capture it.

References

nvd.nist.gov/vuln/detail/CVE-2025-30197 · ADVISORY
jenkinsci/zohoqengine-plugin commit 4ab1db6 · WEB
jenkinsci/zohoqengine-plugin · PACKAGE
jenkins.io/security/advisory/2025-03-19 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free