CVE-2019-10467: Jenkins Sonar Gerrit Plugin stores credentials unencrypted
Summary
CVE-2019-10467: Jenkins Sonar Gerrit Plugin stores credentials unencrypted. Affects org.jenkins-ci.plugins:sonar-gerrit versions < 2.4.5. Fixed in 2.4.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Sonar Gerrit Plugin is a Maven package that integrates SonarQube and Gerrit into Jenkins. It allows users to analyze code quality and post reviews directly from Jenkins. The plugin is widely used in software development pipelines to ensure code quality and facilitate code review processes. However, a vulnerability has been discovered in the plugin that exposes stored credentials in an unencrypted format.
Vulnerability Detail
The Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master. This means that users with Extended Read permission or access to the master file system can view these credentials. The unencrypted storage of credentials poses a significant security risk as it allows unauthorized users to access sensitive information, such as API keys or passwords. This vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Latest published version: 474.v8b_9ea_76d7b_a_a_ as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.4.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the Sonar Gerrit Plugin as soon as possible.
Conclusion
The Jenkins Sonar Gerrit Plugin is vulnerable to storing credentials unencrypted, which can be accessed by unauthorized users. To mitigate this risk, it is crucial to upgrade to version 2.4.5 or later of the Sonar Gerrit Plugin. This version includes a fix that encrypts the stored credentials, ensuring their confidentiality. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:sonar-gerrit →
FAQ
This vulnerability allows unauthorized users to view stored credentials, potentially compromising sensitive information and leading to unauthorized access to systems or services.
Users of the Jenkins Sonar Gerrit Plugin versions prior to 2.4.5 are affected by this vulnerability.
There are no known exploits for this vulnerability at the time of this advisory.
No, this vulnerability requires access to the Jenkins master file system or Extended Read permission.
Yes, users can fix this vulnerability by upgrading to version 2.4.5 or later of the Sonar Gerrit Plugin.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:sonar-gerrit.
