exploitDog

CVE-2022-41255

Опубликовано: 21 сент. 2022

Источник: nvd

CVSS3: 6.5

EPSS Низкий

Описание

Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

Ссылки

http://www.openwall.com/lists/oss-security/2022/09/21/5
Mailing List
Third Party Advisory
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2759
Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/09/21/5
Mailing List
Third Party Advisory
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2759
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jenkins:cons3rt:*:*:*:*:*:jenkins:*:*

Версия до 1.0.0 (включая)

EPSS

Процентиль: 67%

0.00547

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-522

CWE-522

Связанные уязвимости

GHSA-fmq9-r4p2-8272

CVSS3: 3.3

github

больше 3 лет назад

API token stored in plain text by Jenkins CONS3RT Plugin

EPSS

Процентиль: 67%

0.00547

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-522

CWE-522