A flaw was identified in the SonarQube Plugin for Jenkins that disclosed the SonarQube server secret key as used by the plugin. An authenticated remote user with 'Manage Jenkins' privilege could read the secret key as configured via the 'sonar.sonarPassword' parameter. For users of SonarQube v3.7 or later, a mitigation is to use encrypted settings values as described in [1]. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5676 http://seclists.org/fulldisclosure/2013/Dec/37 http://www.osvdb.org/100666 [1] http://docs.codehaus.org/display/SONAR/Settings+Encryption
Statement: Not Vulnerable. The SonarQube plug-in for Jenkins is not shipped by Red Hat.