Lucene search

JenkinsCVE-2022-27218

HistoryMar 15, 2022 - 5:15 p.m.

CVE-2022-27218

2022-03-1517:15:12

CWE-522

jenkins

web.nvd.nist.gov

cve-2022-27218

jenkins

incapptic connect uploader

plugin

vulnerability

nvd

security

unencrypted tokens

config.xml

file system access

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.8

Confidence

High

EPSS

0.001

Percentile

22.0%

JSON

Jenkins incapptic connect uploader Plugin 1.15 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

Affected configurations

Nvd

Node

jenkinsincapptic_connect_uploaderRange≤1.15jenkins

VendorProductVersionCPE
jenkinsincapptic_connect_uploader*cpe:2.3:a:jenkins:incapptic_connect_uploader:*:*:*:*:*:jenkins:*:*

Vendor	Product	Version	CPE
jenkins	incapptic_connect_uploader	*	cpe:2.3:a:jenkins:incapptic_connect_uploader::::::jenkins::*

CNA Affected

[
  {
    "product": "Jenkins incapptic connect uploader Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "1.15",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "unknown",
        "version": "next of 1.15",
        "versionType": "custom"
      }
    ]
  }
]

References

www.openwall.com/lists/oss-security/2022/03/15/2

www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2273

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.8

Confidence

High

EPSS

0.001

Percentile

22.0%

JSON

Related for CVE-2022-27218