ByteOS Network

NVD Vulnerability Details :

CVE-2018-1000425

Analyzed

Source-cve@mitre.org

Published At-09 Jan, 2019 | 23:29

Updated At-24 Aug, 2020 | 17:37

An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attackers with local file system access to obtain the credentials used to connect to SonarQube.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	7.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N

Type: Primary

Version: 3.0

Base score: 7.8

Base severity: HIGH

Vector:

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 2.1

Base severity: LOW

Vector:

AV:L/AC:L/Au:N/C:P/I:N/A:N

CPE Matches

sonarsource>>sonarqube_scanner>>Versions up to 2.8(inclusive)

cpe:2.3:a:sonarsource:sonarqube_scanner:*:*:*:*:*:jenkins:*:*

Weaknesses

CWE ID	Type	Source
CWE-522	Primary	nvd@nist.gov

CWE ID: CWE-522

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://www.securityfocus.com/bid/106532	cve@mitre.org	Third Party Advisory VDB Entry
https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1163	cve@mitre.org	Third Party Advisory

Hyperlink: http://www.securityfocus.com/bid/106532

Source: cve@mitre.org

Resource:

Third Party Advisory

VDB Entry

Hyperlink: https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1163

Source: cve@mitre.org

Resource:

Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History