Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by attackers with Extended Read permission, or access to the Jenkins controller file system.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2022/11/15/4 | Mailing List Third Party Advisory |
| https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2912 | Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2022/11/15/4 | Mailing List Third Party Advisory |
| https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2912 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:29
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.openwall.com/lists/oss-security/2022/11/15/4 - Mailing List, Third Party Advisory | |
| References | () https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2912 - Vendor Advisory |
01 Nov 2023, 20:00
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) http://www.openwall.com/lists/oss-security/2022/11/15/4 - Mailing List, Third Party Advisory |
25 Oct 2023, 18:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
07 Jul 2023, 19:06
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-522 |
Information
Published : 2022-11-15 20:15
Updated : 2024-11-21 07:29
NVD link : CVE-2022-45392
Mitre link : CVE-2022-45392
CVE.ORG link : CVE-2022-45392
JSON object : View
Products Affected
jenkins
- ns-nd_integration_performance_publisher
CWE
CWE-522
Insufficiently Protected Credentials