PT-2022-14830 · Jenkins · Jenkins Metrics Plugin+1

Wasin Saengow · Published 2022-01-12 · Updated 2023-11-30 · CVE-2022-20621

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Metrics Plugin versions 4.0.2.8 and earlier

Description The issue allows an access key to be stored unencrypted in the global configuration file on the Jenkins controller. This access key can be viewed by users with access to the Jenkins controller file system. The file jenkins.metrics.api.MetricsAccessKey.xml is specifically mentioned as part of the configuration where this access key is stored.

Recommendations For Jenkins Metrics Plugin versions 4.0.2.8 and earlier, consider updating to version 4.0.2.8.1 or later, as it stores the access key encrypted once its configuration is saved again. As a temporary workaround, restrict access to the Jenkins controller file system to minimize the risk of the access key being viewed by unauthorized users.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2022-20621

GHSA-GG9M-X3CG-69VH

Affected Products

Jenkins

Jenkins Metrics Plugin

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2022-20621 · Security Note
• https://osv.dev/vulnerability/GHSA-gg9m-x3cg-69vh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-20621 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-01-12/#SECURITY-1624 · Vendor Advisory
• https://github.com/jenkinsci/metrics-plugin/commit/9810480370d4c5e04a2b710934db5461bde0d1b6 · Note
• https://github.com/jenkinsci/metrics-plugin · Note
• https://t.me/cvenotify/25326 · Telegram Post
• http://openwall.com/lists/oss-security/2022/01/12/6 · Note
• https://t.me/cvenotify/61752 · Telegram Post
• https://t.me/cvenotify/25357 · Telegram Post