CVE-2018-1000425

HIGH

Jenkins SonarQube Scanner Plugin <2.8 - Info Disclosure

Title source: llm

Description

An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attackers with local file system access to obtain the credentials used to connect to SonarQube.

References (2)

Core 2

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/106532

Third Party Advisory x_refsource_confirm

https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1163

Scores

CVSS v3 7.8

EPSS 0.0005

EPSS Percentile 14.3%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-522

Status published

Products (2)

org.jenkins-ci.plugins/sonar 0 - 2.8.1Maven

sonarsource/sonarqube_scanner < 2.8

Published Jan 09, 2019

Tracked Since Feb 18, 2026