{"id":"CVE-2019-16545","aliases":["EUVD-2022-2958","GHSA-793w-q2h5-8h5j"],"status":"published","title":"Jenkins QMetry for JIRA Plugin shows plain text password in configuration form","description":"Jenkins QMetry for JIRA - Test Management Plugin transmits credentials in its configuration in plain text as part of job configuration forms, potentially resulting in their exposure.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00541,"percentile":0.45759,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-319"],"published":"2019-11-21T14:11:23Z","modified":"2026-06-17T02:22:24Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:qmetry-for-jira-test-management","fixed_in":["1.14.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:qmetry-for-jira-test-management","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.13"},{"fixed":"1.14.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:qmetry-for-jira-test-management","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0"}]}],"versions":["1.0","1.10","1.11","1.12","1.13","1.2","1.5","1.8","1.9"]}],"products":[{"vendor":"jenkins project","product":"jenkins qmetry for jira - test management plugin"},{"vendor":"qmetry","product":"jenkins_qmetry_for_jira"}],"references":[{"url":"https://jenkins.io/security/advisory/2019-11-21/#SECURITY-727%20%282%29","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2019/11/21/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16545","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-11-21/#SECURITY-727%20(2)","tags":["web"]},{"url":"https://github.com/jenkinsci/qmetry-for-jira-test-management-plugin/commit/6711f566b72c099f10b1cecab406786ca998651d","tags":["web"]},{"url":"https://github.com/advisories/GHSA-793w-q2h5-8h5j"}],"sources":{"cve":[{"id":"CVE-2019-16545","description":"Jenkins QMetry for JIRA - Test Management Plugin transmits credentials in its configuration in plain text as part of job configuration forms, potentially resulting in their exposure.","status":"published","published":"2019-11-21T14:11:23Z","modified":"2024-08-05T01:17:40.302Z","updated_at":"2026-11-02T14:32:23.189113Z"}],"euvd":[{"id":"EUVD-2022-2958","description":"Jenkins QMetry for JIRA - Test Management Plugin transmits credentials in its configuration in plain text as part of job configuration forms, potentially resulting in their exposure.","status":"published","published":"2019-11-21T14:11:23Z","modified":"2024-08-05T01:17:40Z","updated_at":"2026-11-03T02:40:32.752495Z"}],"ghsa":[{"id":"GHSA-793w-q2h5-8h5j","title":"Jenkins QMetry for JIRA Plugin shows plain text password in configuration form","description":"Jenkins QMetry for JIRA - Test Management Plugin stores a credential as part of its post-build step configuration.\n\nWhile the password is stored encrypted on disk since QMetry for JIRA - Test Management Plugin 1.13, it is transmitted in plain text as part of the configuration form. This can result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations.","status":"published","published":"2022-05-24T17:01:41Z","modified":"2023-10-27T17:39:59Z","cvss":[{"version":"3.0","score":3.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T14:37:10.633403Z"}],"nvd":[{"id":"CVE-2019-16545","description":"Jenkins QMetry for JIRA - Test Management Plugin transmits credentials in its configuration in plain text as part of job configuration forms, potentially resulting in their exposure.","status":"published","published":"2019-11-21T15:15:14.54Z","modified":"2026-06-17T02:22:24.273Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T14:05:37.024431Z"}],"osv":[{"id":"GHSA-793w-q2h5-8h5j","title":"Jenkins QMetry for JIRA Plugin shows plain text password in configuration form","description":"Jenkins QMetry for JIRA - Test Management Plugin stores a credential as part of its post-build step configuration.\n\nWhile the password is stored encrypted on disk since QMetry for JIRA - Test Management Plugin 1.13, it is transmitted in plain text as part of the configuration form. This can result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations.","status":"published","published":"2022-05-24T17:01:41Z","modified":"2024-02-16T08:16:21.865053Z","cvss":[{"version":"3.0","score":3.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T15:46:40.657155Z"}]}}