Low severity3.1NVD Advisory· Published Mar 19, 2025· Updated Jun 17, 2026

CVE-2025-30197

Description

Jenkins Zoho QEngine Plugin 1.0.29.vfa_cc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for attackers to observe and capture it.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
io.jenkins.plugins:zohoqengineMaven	< 1.0.31.v4a_b_1db_6d6a_f2	1.0.31.v4a_b_1db_6d6a_f2

Affected products

Jenkins Project/Zoho Qengine
cpe:2.3:a:jenkins:zoho_qengine:*:*:*:*:*:jenkins:*:*
Range: <=1.0.29.vfa_cc23396502
ghsa-coords
pkg:maven/io.jenkins.plugins/zohoqengine
Range: < 1.0.31.v4a_b_1db_6d6a_f2
Jenkins Project/Zoho QEngine Plugincpe-rescue
Range: 0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-2x3g-rr4w-4qrpghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-30197ghsaADVISORY
www.jenkins.io/security/advisory/2025-03-19/nvdVendor AdvisoryWEB
github.com/jenkinsci/zohoqengine-plugin/commit/4ab1db6d6af21f43dd15cc328599445519875fa8ghsaWEB

News mentions

Jenkins Security Advisory 2025-03-19
Jenkins Security Advisories · Mar 19, 2025

cvss	0.202
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000