low3.1
CVE-2025-30197
Jenkins Zoho QEngine Plugin Displays Unmasked API Keys
Impact
Jenkins Zoho QEngine Plugin 1.0.29.vfa_cc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for attackers to observe and capture it.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.jenkins.plugins:zohoqengine | < 1.0.31.v4a | 1.0.31.v4a_b_1db_6d6a_f2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Zoho Qengine | through 1.0.29.vfa_cc23396502 |