Jenkins incapptic connect uploader Plugin 1.15 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2022/03/15/2 | Mailing List Third Party Advisory |
| https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2273 | Vendor Advisory |
Configurations
History
18 Jul 2023, 13:53
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-522 |
25 Mar 2022, 13:57
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:jenkins:incapptic_connect_uploader:*:*:*:*:*:jenkins:*:* | |
| CWE | NVD-CWE-noinfo | |
| CVSS |
v2 : v3 : |
v2 : 4.0
v3 : 4.3 |
| References | (MLIST) http://www.openwall.com/lists/oss-security/2022/03/15/2 - Mailing List, Third Party Advisory | |
| References | (CONFIRM) https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2273 - Vendor Advisory |
15 Mar 2022, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
15 Mar 2022, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-03-15 17:15
Updated : 2024-02-04 22:29
NVD link : CVE-2022-27218
Mitre link : CVE-2022-27218
CVE.ORG link : CVE-2022-27218
JSON object : View
Products Affected
jenkins
- incapptic_connect_uploader
CWE
CWE-522
Insufficiently Protected Credentials