Jenkins Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2022/03/15/2 | Mailing List Third Party Advisory |
| https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2238 | Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2022/03/15/2 | Mailing List Third Party Advisory |
| https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2238 | Vendor Advisory |
Configurations
History
21 Nov 2024, 06:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.openwall.com/lists/oss-security/2022/03/15/2 - Mailing List, Third Party Advisory | |
| References | () https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2238 - Vendor Advisory |
21 Dec 2023, 21:55
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:jenkins:vmware_vrealize_codestream:*:*:*:*:*:jenkins:*:* | |
| First Time |
Jenkins vmware Vrealize Codestream
|
Information
Published : 2022-03-15 17:15
Updated : 2024-11-21 06:55
NVD link : CVE-2022-27217
Mitre link : CVE-2022-27217
CVE.ORG link : CVE-2022-27217
JSON object : View
Products Affected
jenkins
- vmware_vrealize_codestream
CWE
CWE-522
Insufficiently Protected Credentials