CVE-2022-41255

Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

CVSS v3.0 6.5 MEDIUM

6.5^/10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2759	Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/09/21/5	Mailing List

Configurations

Configuration 1 (hide)

cpe:2.3:a:jenkins:cons3rt:*:*:*:*:*:jenkins:*:*

Information

Published : 2022-09-21 09:15

Updated : 2022-09-22 11:47

NVD link : CVE-2022-41255

Mitre link : CVE-2022-41255

JSON object : View

CWE

CWE-256

Plaintext Storage of a Password

Products Affected

jenkins

cons3rt

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2759", "name": "https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2759", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.openwall.com/lists/oss-security/2022/09/21/5", "name": "[oss-security] 20220921 Multiple vulnerabilities in Jenkins and Jenkins plugins", "tags": ["Mailing List"], "refsource": "MLIST"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-256"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-41255", "ASSIGNER": "jenkinsci-cert@googlegroups.com"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}}, "publishedDate": "2022-09-21T16:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:jenkins:cons3rt:*:*:*:*:*:jenkins:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "1.0.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-09-22T18:47Z"}

6.5 /10