PT-2022-25763 · Jenkins · Jenkins Bigpanda Notifier Plugin+1

Marc Heyries · Published 2022-09-21 · Updated 2023-11-01 · CVE-2022-41248

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins BigPanda Notifier Plugin versions 1.4.0 and earlier

Description The issue concerns the storage and display of the BigPanda API key in the plugin's configuration. The BigPanda API key is stored unencrypted in the BigpandaGlobalNotifier.xml file on the Jenkins controller. This key can be accessed by users with file system access to the Jenkins controller. Furthermore, the global configuration form does not mask the API key, making it possible for attackers to observe and capture it.

Recommendations For Jenkins BigPanda Notifier Plugin versions 1.4.0 and earlier, consider restricting access to the Jenkins controller file system to minimize the risk of the API key being viewed. As a temporary workaround, manually encrypt and securely store the BigPanda API key until a patch is available. Avoid using the plugin's global configuration form to input the API key until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

CWE-549

Related Identifiers

CVE-2022-41248

GHSA-CPM5-CQR9-7P79

Affected Products

Jenkins

Jenkins Bigpanda Notifier Plugin

References · 6

• https://osv.dev/vulnerability/GHSA-cpm5-cqr9-7p79 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-09-21/#SECURITY-2243 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41248 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41248 · Vendor Advisory
• https://github.com/jenkinsci/bigpanda-plugin · Note
• http://openwall.com/lists/oss-security/2022/09/21/5 · Note