PT-2022-6642 · Cisco+1 · Jenkins Cisco Spark Plugin+1

Long Nguyen · Published 2022-06-30 · Updated 2023-11-22 · CVE-2022-34808

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Cisco Spark Plugin versions 1.1.1 and earlier

Description The issue is related to the storage of bearer tokens in an unencrypted form in the global configuration file org.jenkinsci.plugins.spark.SparkNotifier.xml on the Jenkins controller. This could allow a remote attacker to gain unauthorized access to sensitive information. Users with access to the Jenkins controller file system can view these bearer tokens.

Recommendations For Jenkins Cisco Spark Plugin versions 1.1.1 and earlier, consider removing or encrypting the bearer tokens stored in the org.jenkinsci.plugins.spark.SparkNotifier.xml file to prevent unauthorized access. As a temporary workaround, restrict access to the Jenkins controller file system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

CWE-256

Related Identifiers

BDU:2023-03021

CVE-2022-34808

GHSA-WPPP-XQFV-6CM7

Affected Products

Jenkins

Jenkins Cisco Spark Plugin

References · 6

• https://jenkins.io/security/advisory/2022-06-30/#SECURITY-2055 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-34808 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34808 · Security Note
• https://bdu.fstec.ru/vul/2023-03021 · Security Note
• https://osv.dev/vulnerability/GHSA-wppp-xqfv-6cm7 · Vendor Advisory
• https://github.com/jenkinsci/cisco-spark-plugin · Note