PT-2022-25762 · Jenkins · Jenkins Bigpanda Notifier Plugin+1

Marc Heyries · Published 2022-09-21 · Updated 2023-11-13 · CVE-2022-41247

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins BigPanda Notifier Plugin versions 1.4.0 and earlier

Description The issue concerns the storage of the BigPanda API key in an unencrypted form within the global configuration file on the Jenkins controller. This file can be accessed by users with permission to the Jenkins controller file system. The global configuration form also fails to mask the API key, potentially allowing attackers to observe and capture it. The key is stored in the BigpandaGlobalNotifier.xml file as part of the plugin's configuration.

Recommendations For Jenkins BigPanda Notifier Plugin versions 1.4.0 and earlier, consider restricting access to the Jenkins controller file system to minimize the risk of the API key being viewed by unauthorized users. As a temporary workaround, limit the access to the BigpandaGlobalNotifier.xml file until a patch is available. Additionally, avoid displaying the API key in the global configuration form to prevent potential observation and capture by attackers. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

CWE-256

Related Identifiers

CVE-2022-41247

GHSA-J7XV-FC46-HGPG

Affected Products

Jenkins

Jenkins Bigpanda Notifier Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-41247 · Security Note
• https://jenkins.io/security/advisory/2022-09-21/#SECURITY-2243 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j7xv-fc46-hgpg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41247 · Vendor Advisory
• https://github.com/jenkinsci/bigpanda-plugin · Note
• https://t.me/cibsecurity/50205 · Telegram Post