Bug 2044507 (CVE-2022-20621) - CVE-2022-20621 jenkins-2-plugins/metrics: stores access keys unencrypted in its global configuration file
Summary: CVE-2022-20621 jenkins-2-plugins/metrics: stores access keys unencrypted in i...
Keywords:
Status: NEW
Alias: CVE-2022-20621
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2044959 2047839
Blocks: 2044461
TreeView+ depends on / blocked
 
Reported: 2022-01-24 17:34 UTC by Michael Kaplan
Modified: 2023-07-07 08:35 UTC (History)
10 users (show)

Fixed In Version: metrics plugin 4.0.2.8.1
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Michael Kaplan 2022-01-24 17:34:47 UTC 
Jenkins Metrics Plugin 4.0.2.8 and earlier stores an access key unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

Reference:

https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-1624
Note You need to log in before you can comment on or make changes to this bug.