PT-2022-22357 · Jenkins · Jenkins Skype Notifier Plugin+1

S0Nnguy3N + 1 · Published 2022-06-30 · Updated 2023-11-22 · CVE-2022-34805

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Skype notifier Plugin versions 1.1.0 and earlier

Description The issue concerns the storage of a password in an unencrypted form within the global configuration file on the Jenkins controller. This password is stored in the file hudson.plugins.skype.im.transport.SkypePublisher.xml as part of the plugin's configuration and can be accessed by users with file system access to the Jenkins controller.

Recommendations For Jenkins Skype notifier Plugin versions 1.1.0 and earlier, consider removing or encrypting the stored password in the hudson.plugins.skype.im.transport.SkypePublisher.xml file to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

CWE-256

Related Identifiers

CVE-2022-34805

GHSA-GVMR-MP5Q-9WVW

Affected Products

Jenkins

Jenkins Skype Notifier Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-34805 · Security Note
• https://jenkins.io/security/advisory/2022-06-30/#SECURITY-2160 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-34805 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gvmr-mp5q-9wvw · Vendor Advisory
• https://github.com/jenkinsci/skype-im-plugin · Note
• https://t.me/cibsecurity/45456 · Telegram Post