CVE-2025-30197: 
Java vulnerability analysis and mitigation

Jenkins Zoho QEngine Plugin version 1.0.29.vfa_cc23396502 and earlier contains a security vulnerability related to unmasked API key form fields. The vulnerability was discovered in March 2025 and assigned identifier CVE-2025-30197. The issue affects the QEngine API Key configuration in the Jenkins plugin (Jenkins Advisory).

The vulnerability stems from the plugin's implementation of API key storage, where the QEngine API Key is stored in job config.xml files on the Jenkins controller as part of its configuration. While the key is stored in an encrypted format on disk, the job configuration form does not mask the QEngine API Key form field in affected versions. The vulnerability has been assigned a Low severity CVSS rating (Jenkins Advisory).

The vulnerability increases the potential for attackers to observe and capture the QEngine API Key by viewing the unmasked form field in the job configuration interface (Jenkins Advisory, NVD).

The vulnerability has been fixed in Zoho QEngine Plugin version 1.0.31.v4ab1db6d6af2, which properly masks the QEngine API Key form field. Users are advised to upgrade to this version to address the security issue (Jenkins Advisory).