PT-2022-17127 · Jenkins · Jenkins Support Core Plugin+1

James Nord · Published 2022-02-15 · Updated 2023-11-30 · CVE-2022-25187

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Support Core Plugin versions 2.79 and earlier

Description The issue concerns the Jenkins Support Core Plugin, which does not properly redact some sensitive information in the support bundle. This could potentially expose sensitive data. Support Core Plugin 2.79.1 adds a list of keywords whose associated values are redacted, indicating an improvement in handling sensitive information.

Recommendations For Jenkins Support Core Plugin versions 2.79 and earlier, update to version 2.79.1 or later to ensure that sensitive information is properly redacted in the support bundle.

Fix

Insufficiently Protected Credentials

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-522

CWE-312

CWE-212

Related Identifiers

CVE-2022-25187

GHSA-5M8F-V3GW-H94W

Affected Products

Jenkins

Jenkins Support Core Plugin

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2022-25187 · Security Note
• https://jenkins.io/security/advisory/2022-02-15/#SECURITY-2186 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25187 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5m8f-v3gw-h94w · Vendor Advisory
• https://github.com/jenkinsci/support-core-plugin/commit/c6d20da4f372f03bd3e4844f0df2f109df68a63c · Note
• https://github.com/jenkinsci/support-core-plugin · Note
• https://github.com/jenkinsci/support-core-plugin/commit/e90487a87bc0a3445c887203f5badec17af905c5 · Note
• https://t.me/cvenotify/61764 · Telegram Post
• https://t.me/cibsecurity/37517 · Telegram Post
• https://t.me/cvenotify/53991 · Telegram Post
• https://t.me/cvenotify/26821 · Telegram Post