PT-2022-22360 · Jenkins · Jenkins Rqm Plugin+1

S0Nnguy3N + 1 · Published 2022-06-30 · Updated 2023-11-22 · CVE-2022-34809

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins RQM Plugin versions 2.8 and earlier

Description The issue concerns the storage of a password in an unencrypted form within the global configuration file on the Jenkins controller. Specifically, the password is stored in the net.praqma.jenkins.rqm.RqmBuilder.xml file. This unencrypted password can be accessed by users who have permission to view the Jenkins controller file system.

Recommendations For Jenkins RQM Plugin versions 2.8 and earlier, consider updating to a version that properly encrypts passwords in the global configuration file to prevent unauthorized access. As a temporary workaround, restrict access to the Jenkins controller file system to minimize the risk of the unencrypted password being viewed by unauthorized users.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

CWE-256

Related Identifiers

CVE-2022-34809

GHSA-M59Q-VGQ9-75CR

Affected Products

Jenkins

Jenkins Rqm Plugin

References · 6

• https://osv.dev/vulnerability/GHSA-m59q-vgq9-75cr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34809 · Security Note
• https://jenkins.io/security/advisory/2022-06-30/#SECURITY-2155 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-34809 · Vendor Advisory
• https://github.com/jenkinsci/rqm-plugin · Note
• https://t.me/cibsecurity/45455 · Telegram Post