PT-2022-26910 · Jenkins · Jenkins S3 Explorer Plugin+1

Bram Mertens · Published 2022-10-19 · Updated 2025-05-08 · CVE-2022-43426

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins S3 Explorer Plugin versions 1.0.8 and earlier

Description The issue concerns the Jenkins S3 Explorer Plugin, where the AWS SECRET ACCESS KEY form field is not masked, increasing the potential for attackers to observe and capture it. This secret is stored encrypted on disk in the s3explorer.xml file on the Jenkins controller as part of its configuration. However, in versions 1.0.8 and earlier, the global configuration form does not mask the AWS SECRET ACCESS KEY form field.

Recommendations For Jenkins S3 Explorer Plugin versions 1.0.8 and earlier, consider disabling the plugin until a patch is available to prevent potential attackers from observing and capturing the AWS SECRET ACCESS KEY. Restrict access to the global configuration form to minimize the risk of exploitation. Avoid using the AWS SECRET ACCESS KEY form field in the affected plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-549

CWE-256

Related Identifiers

CVE-2022-43426

GHSA-MF4P-WJRM-CMJP

Affected Products

Jenkins

Jenkins S3 Explorer Plugin

References · 8

• https://jenkins.io/security/advisory/2022-10-19/#SECURITY-2480 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43426 · Security Note
• https://osv.dev/vulnerability/GHSA-mf4p-wjrm-cmjp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-43426 · Vendor Advisory
• https://github.com/jenkinsci/s3explorer-plugin · Note
• http://openwall.com/lists/oss-security/2022/10/19/3 · Note
• https://t.me/cvenotify/121439 · Telegram Post
• https://t.me/cibsecurity/51802 · Telegram Post