Lucene search

JenkinsCVELIST:CVE-2022-34802

HistoryJun 30, 2022 - 5:48 p.m.

CVE-2022-34802

2022-06-3017:48:14

jenkins

www.cve.org

jenkins

rocketchat

notifier plugin

unencrypted

global configuration

file system

access

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

22.0%

JSON

Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password and webhook token unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

CNA Affected

[
  {
    "product": "Jenkins RocketChat Notifier Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "1.5.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "unknown",
        "version": "next of 1.5.2",
        "versionType": "custom"
      }
    ]
  }
]

References

www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2088