Lucene search

JenkinsCVE-2022-34803

HistoryJun 30, 2022 - 6:15 p.m.

CVE-2022-34803

2022-06-3018:15:14

CWE-522

jenkins

web.nvd.nist.gov

598

cve-2022-34803

jenkins

opsgenie

plugin

api keys

unencrypted

global configuration

job config.xml

jenkins controller

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.8

Confidence

High

EPSS

0.001

Percentile

22.0%

JSON

Jenkins OpsGenie Plugin 1.9 and earlier stores API keys unencrypted in its global configuration file and in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission (config.xml), or access to the Jenkins controller file system.

Affected configurations

Nvd

Node

jenkinsopsgenieRange≤1.9jenkins

VendorProductVersionCPE
jenkinsopsgenie*cpe:2.3:a:jenkins:opsgenie:*:*:*:*:*:jenkins:*:*

Vendor	Product	Version	CPE
jenkins	opsgenie	*	cpe:2.3:a:jenkins:opsgenie::::::jenkins::*

CNA Affected

[
  {
    "product": "Jenkins OpsGenie Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "1.9",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "unknown",
        "version": "next of 1.9",
        "versionType": "custom"
      }
    ]
  }
]

References

www.jenkins.io/security/advisory/2022-06-30/#SECURITY-1877

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.8

Confidence

High

EPSS

0.001

Percentile

22.0%

JSON

Related for CVE-2022-34803