Jenkins Proxmox Plugin 0.5.0 and earlier stores the Proxmox Datacenter password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2022/03/29/1 | Mailing List Third Party Advisory |
| https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2079 | Vendor Advisory |
Configurations
History
04 Apr 2022, 19:57
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 4.0
v3 : 6.5 |
| References | (CONFIRM) https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2079 - Vendor Advisory | |
| References | (MLIST) http://www.openwall.com/lists/oss-security/2022/03/29/1 - Mailing List, Third Party Advisory | |
| CWE | CWE-522 | |
| CPE | cpe:2.3:a:jenkins:proxmox:*:*:*:*:*:jenkins:*:* |
29 Mar 2022, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
29 Mar 2022, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-03-29 13:15
Updated : 2024-02-04 22:29
NVD link : CVE-2022-28141
Mitre link : CVE-2022-28141
CVE.ORG link : CVE-2022-28141
JSON object : View
Products Affected
jenkins
- proxmox
CWE
CWE-522
Insufficiently Protected Credentials