CVE-2019-1003048

Vulnerability

Jenkins PRQA Plugin 3.1.0 and earlier stores the password used to connect to PRQA in plaintext in the plugin configuration file (PRQAScannerConfig.xml) within the Jenkins home directory. This vulnerability allows any attacker with local file system access to the Jenkins home directory to read the unencrypted password.

Exploitation

An attacker needs local file system access to the Jenkins home directory (e.g., through a compromised Jenkins agent, shared filesystem, or other means). The attacker can then navigate to the plugin configuration file and read the password directly. No authentication to Jenkins or user interaction is required beyond having file read access.

Impact

Successful exploitation results in disclosure of the PRQA password, which could be used to gain unauthorized access to the PRQA system or other resources using that credential. The attacker obtains the password in plaintext without privilege escalation within Jenkins itself.

Mitigation

Jenkins PRQA Plugin 2.9.0 switched to storing the password as a credential instead of plaintext configuration [1]. Users should update to version 2.9.0 or later. As of this advisory, no workaround is available for earlier versions; upgrading is the only mitigation.