CVE-2022-28135

2022-03-2913:15:08

Google

osv.dev

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.5%

JSON

Jenkins instant-messaging Plugin 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins based on Jenkins instant-messaging Plugin on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

CPENameOperatorVersion
instant-messaging-plugineqinstant-messaging-1.38
instant-messaging-plugineqinstant-messaging-1.20
instant-messaging-plugineqinstant-messaging-1.23
instant-messaging-plugineqinstant-messaging-1.28
instant-messaging-plugineqinstant-messaging-1.18
instant-messaging-plugineqinstant-messaging-1.35
instant-messaging-plugineqinstant-messaging-1.32
instant-messaging-plugineqinstant-messaging-1.21
instant-messaging-plugineqinstant-messaging-1.31
instant-messaging-plugineqinstant-messaging-1.25

Name	Operator	Version
instant-messaging-plugin	eq	instant-messaging-1.38
instant-messaging-plugin	eq	instant-messaging-1.20
instant-messaging-plugin	eq	instant-messaging-1.23
instant-messaging-plugin	eq	instant-messaging-1.28
instant-messaging-plugin	eq	instant-messaging-1.18
instant-messaging-plugin	eq	instant-messaging-1.35
instant-messaging-plugin	eq	instant-messaging-1.32
instant-messaging-plugin	eq	instant-messaging-1.21
instant-messaging-plugin	eq	instant-messaging-1.31
instant-messaging-plugin	eq	instant-messaging-1.25