PT-2022-22355 · Jenkins · Jenkins Opsgenie Plugin+1

Kevin Guerroudj + 2 · Published 2022-06-30 · Updated 2023-11-22 · CVE-2022-34803

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins OpsGenie Plugin versions 1.9 and earlier

Description The issue concerns the storage of API keys in an unencrypted manner within the global configuration file and job config.xml files on the Jenkins controller. These keys can be accessed by users with Extended Read permission for job config.xml files or by those with access to the Jenkins controller file system. The API keys are also transmitted in plain text as part of configuration forms. This could potentially allow unauthorized access to sensitive information.

Recommendations For Jenkins OpsGenie Plugin versions 1.9 and earlier, as a temporary workaround, consider restricting access to the global configuration file com.opsgenie.integration.jenkins.OpsGenieNotifier.xml and job config.xml files to minimize the risk of exploitation. Additionally, limit the permissions of users with Item/Extended Read permission to reduce the attack surface. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

CWE-256

Related Identifiers

CVE-2022-34803

GHSA-273C-FJW8-V2W8

Affected Products

Jenkins

Jenkins Opsgenie Plugin

References · 6

• https://osv.dev/vulnerability/GHSA-273c-fjw8-v2w8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-34803 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-06-30/#SECURITY-1877 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34803 · Security Note
• https://github.com/jenkinsci/opsgenie-plugin · Note
• https://t.me/cvenotify/32769 · Telegram Post