CVE-2013-5676
Jenkins SonarQube Plugin Stores Passwords in Cleartext
CVE-2013-5676 is a medium vulnerability (CVSS 4.0) in Sonarsource Jenkins Plugin, published December 13, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.99%, the 92nd percentile. No source names a fixed version.
- Severity
- 4.0 MediumCVSS 2.0, NVD
- Exploit chance
- 4.99%EPSS, 92nd percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:sonarMaven | through 3.7 | None known |
org.jenkins-ci.plugins:sonarMaven | through 3.7, plus listed versions 2.12.102.112.122.13 Show 30 moreShow less2.13.12.142.152.162.16.12.172.17.12.17.22.17.32.182.18.12.18.22.18.32.19.02.22.2.12.32.42.4.12.4.22.4.32.4.42.52.62.6.12.72.7.12.82.8.12.9 | None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | SonarQube Jenkins Plugin - Plain Text Password | 2013-12-18 |
What each source reports
NVD Score used
The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.
- Record
CVE-2013-5676- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE ListNo score
The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.
- Record
CVE-2013-5676- Updated
- 2026-11-02
EUVDEUVD-2013-5514No score
The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.
- Record
EUVD-2013-5514- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3x9h-3p7m-33m7
Jenkins SonarQube Plugin Stores Passwords in Cleartext
The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.
- Record
GHSA-3x9h-3p7m-33m7- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-312
- Updated
- 2026-11-02
OSVGHSA-3x9h-3p7m-33m7
Jenkins SonarQube Plugin Stores Passwords in Cleartext
The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.
- Record
GHSA-3x9h-3p7m-33m7- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-312
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.