PT-2022-18306 · Jenkins · Jenkins Incapptic Connect Uploader Plugin+1

Quentin Parra · Published 2022-03-15 · Updated 2023-12-21 · CVE-2022-27218

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins incapptic connect uploader Plugin versions 1.15 and earlier

Description The issue allows tokens to be stored unencrypted in job config.xml files on the Jenkins controller. These tokens can be viewed by users with Extended Read permission or those who have access to the Jenkins controller file system.

Recommendations For Jenkins incapptic connect uploader Plugin versions 1.15 and earlier, update to a version later than 1.15 to resolve the issue.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

CWE-256

Related Identifiers

CVE-2022-27218

GHSA-8G9W-5JV6-7M4X

Affected Products

Jenkins

Jenkins Incapptic Connect Uploader Plugin

References · 9

• https://osv.dev/vulnerability/CVE-2022-27218 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-03-15/#SECURITY-2273 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27218 · Security Note
• https://osv.dev/vulnerability/GHSA-8g9w-5jv6-7m4x · Vendor Advisory
• https://github.com/jenkinsci/incapptic-connect-uploader-plugin · Note
• https://t.me/cvenotify/54560 · Telegram Post
• https://t.me/cibsecurity/38954 · Telegram Post
• http://openwall.com/lists/oss-security/2022/03/15/2 · Note
• https://t.me/cvenotify/64771 · Telegram Post