CVE-2022-36901

2022-07-2714:25:00

jenkins

www.cve.org

jenkins

http request

unencrypted passwords

global configuration

file system

access

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

28.4%

JSON

Jenkins HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

CNA Affected

[
  {
    "product": "Jenkins HTTP Request Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "1.15",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "unknown",
        "version": "next of 1.15",
        "versionType": "custom"
      }
    ]
  }
]