Insecure Storage of Credentials in Jenkins RocketChat Notifier Plugin
CVE-2022-34802

4.3MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Rocketchat Notifier Plugin
Vendor
CVE Published:
30 June 2022

Summary

The Jenkins RocketChat Notifier Plugin prior to version 1.5.3 stores sensitive information, including login passwords and webhook tokens, in an unencrypted format within its global configuration file on the Jenkins controller. This poses a significant risk as the stored credentials can be easily accessed by users who have filesystem access to the Jenkins controller, potentially compromising the security of the system and the integrity of the communication with the RocketChat service.

Affected Version(s)

Jenkins RocketChat Notifier Plugin <= 1.5.2

References

https://www.jenkins.io/security/advisory/2022-06-30/#SECU...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.