CVE-2022-41255

2022-09-2115:46:12

jenkins

www.cve.org

jenkins

cons3rt

plugin

vulnerability

storing

unencrypted

cons3rt

api

token

files

jenkins controller

file system

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

28.4%

JSON

Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

CNA Affected

[
  {
    "product": "Jenkins CONS3RT Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "1.0.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "unknown",
        "version": "next of 1.0.0",
        "versionType": "custom"
      }
    ]
  }
]