CVE-2019-16544

8.8 highEPSS 0.8%

Jenkins QMetry for JIRA - Test Management Plugin 1.12 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
CWE: CWE-522
Published: 2019-11-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

qmetry:jenkins_qmetry_for_jira

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-8mjp-8c2x-3g7w	Maven	org.jenkins-ci.plugins:qmetry-for-jira-test-management	<1.13	1.13

References

http://www.openwall.com/lists/oss-security/2019/11/21/1
https://jenkins.io/security/advisory/2019-11-21/#SECURITY-727%20%281%29
http://www.openwall.com/lists/oss-security/2019/11/21/1
https://jenkins.io/security/advisory/2019-11-21/#SECURITY-727%20%281%29

Check your stack JSON