CVE-2022-27195

· MEDIUMModified

← All CVEs

CVSS v3.1

5.5

EPSS

0.38%

Published

Mar 15, 2022

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Jenkins Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Jenkins Parameterized Trigger Plugin, including password parameter values, in their `build.xml` files. These values are stored unencrypted and can be viewed by users with access to the Jenkins controller file system.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected Products (1)

jenkins · parameterized_trigger (up to 2.43.1)vulnerable

References (4)

http://www.openwall.com/lists/oss-security/2022/03/15/2

Mailing ListThird Party Advisory

https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2185

Vendor Advisory

http://www.openwall.com/lists/oss-security/2022/03/15/2

Mailing ListThird Party Advisory

https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2185

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs