Unencrypted JDBC Passwords Vulnerability in Jenkins dbCharts Plugin
CVE-2022-27216

6.5MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Dbcharts Plugin
Vendor
CVE Published:
15 March 2022

Summary

The Jenkins dbCharts Plugin prior to version 0.5.3 has a significant security flaw where JDBC connection passwords are stored in an unencrypted format within the global configuration file of the Jenkins controller. This configuration file can be accessed by any user with file system permissions to the Jenkins controller, leading to potential unauthorized access to sensitive database credentials. It is crucial for Jenkins administrators to upgrade to at least version 0.5.3 to mitigate the risk associated with this vulnerability and protect sensitive data from exposure.

Affected Version(s)

Jenkins dbCharts Plugin <= 0.5.2

References

https://www.jenkins.io/security/advisory/2022-03-15/#SECU...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2022/03/15/2
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.