Threats tagged 'ghsa-p9gh-rpjw-78qg'

The Jenkins QMetry Test Management Plugin version 1.13 and earlier stores QMetry Automation API keys unencrypted in job configuration files on the Jenkins controller. These keys are accessible to users with Item/Extended Read permission or those with file system access to the Jenkins controller. The plugin's job configuration form also does not mask the API keys, increasing the risk of exposure. No fix is currently available for this vulnerability.