PT-2022-22368 · Hewlett Packard+1 · Jenkins Hpe Network Virtualization Plugin+1

Long Nguyen · Published 2022-06-30 · Updated 2023-11-22 · CVE-2022-34816

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins HPE Network Virtualization Plugin version 1.0

Description The issue concerns the storage of passwords in an unencrypted manner within the global configuration file on the Jenkins controller. Specifically, the org.jenkinsci.plugins.nvemulation.plugin.NvEmulationBuilder.xml file contains these unencrypted passwords as part of its configuration. Users with access to the Jenkins controller file system can view these passwords.

Recommendations For Jenkins HPE Network Virtualization Plugin version 1.0, consider restricting access to the Jenkins controller file system to minimize the risk of password exposure. As a temporary workaround, limit the privileges of users who have access to the file system to reduce potential damage.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

CWE-256

Related Identifiers

CVE-2022-34816

GHSA-36J8-F33J-VJWQ

Affected Products

Jenkins

Jenkins Hpe Network Virtualization Plugin

References · 5

• https://osv.dev/vulnerability/GHSA-36j8-f33j-vjwq · Vendor Advisory
• https://jenkins.io/security/advisory/2022-06-30/#SECURITY-2080 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34816 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34816 · Vendor Advisory
• https://github.com/jenkinsci/hpe-network-virtualization-plugin · Note