CVE-2013-5676
Jenkins SonarQube Plugin Stores Passwords in Cleartext
CVE-2013-5676 is a medium vulnerability (CVSS 4.0) in Sonarsource Jenkins Plugin, published December 13, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.99%, the 92nd percentile. No source names a fixed version.
The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.
Exploit likelihood
What each source reports
NVD Score used
The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.
- Record
CVE-2013-5676- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.
- Record
CVE-2013-5676- Updated
- 2026-11-02
EUVDEUVD-2013-5514 No score
The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.
- Record
EUVD-2013-5514- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3x9h-3p7m-33m7
Jenkins SonarQube Plugin Stores Passwords in Cleartext
The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.
- Record
GHSA-3x9h-3p7m-33m7- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-312
- Updated
- 2026-11-02
OSVGHSA-3x9h-3p7m-33m7
Jenkins SonarQube Plugin Stores Passwords in Cleartext
The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.
- Record
GHSA-3x9h-3p7m-33m7- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-312
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:sonarMaven |
through 3.7 | None known |
org.jenkins-ci.plugins:sonarMaven |
through 3.7, plus listed versions 2.12.102.112.122.13 Show 30 moreShow less2.13.12.142.152.162.16.12.172.17.12.17.22.17.32.182.18.12.18.22.18.32.19.02.22.2.12.32.42.4.12.4.22.4.32.4.42.52.62.6.12.72.7.12.82.8.12.9 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | SonarQube Jenkins Plugin - Plain Text Password | 2013-12-18 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |