PT-2022-18281 · Jenkins · Jenkins Parameterized Trigger Plugin+1

Gunther Rademacher · Published 2022-03-15 · Updated 2023-11-22 · CVE-2022-27195

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Parameterized Trigger Plugin versions 2.43 and earlier

Description The issue concerns the capture and storage of environment variables, including password parameter values, in build.xml files by the Jenkins Parameterized Trigger Plugin. These values are stored unencrypted and can be accessed by users with permission to the Jenkins controller file system. The problem also involves existing build.xml files not being automatically updated to remove captured environment variables, requiring manual cleanup. The plugin reports stored environment variables as unloadable data in the Old Data Monitor, allowing for their removal.

Recommendations For Jenkins Parameterized Trigger Plugin versions 2.43 and earlier, manually clean up existing build.xml files to remove captured environment variables. Utilize the Old Data Monitor to identify and discard stored environment variables. Consider restricting access to the Jenkins controller file system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2022-27195

GHSA-5MPF-HW8F-86W9

Affected Products

Jenkins

Jenkins Parameterized Trigger Plugin

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2022-27195 · Security Note
• https://jenkins.io/security/advisory/2022-03-15/#SECURITY-2185 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5mpf-hw8f-86w9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-27195 · Vendor Advisory
• https://github.com/jenkinsci/parameterized-trigger-plugin/commit/6b7cd2272cbd9f97416bff7ea19132b9aad0898d · Note
• https://github.com/jenkinsci/parameterized-trigger-plugin/commit/b5ec2b48df3c4f7b4999c4edf137b34fbea694fd · Note
• https://github.com/jenkinsci/parameterized-trigger-plugin · Note
• http://openwall.com/lists/oss-security/2022/03/15/2 · Note
• https://t.me/cibsecurity/38936 · Telegram Post