CVE-2022-27206

MEDIUM

Jenkins Gitlab Authentication - Insufficiently Protected Credentials

Title source: rule

Description

Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

References (2)

Scores

CVSS v3 6.5
EPSS 0.0016
EPSS Percentile 37.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Classification

CWE
CWE-522
Status published

Affected Products (2)

jenkins/gitlab_authentication < 1.13
org.jenkins-ci.plugins/gitlab-oauth < 1.14Maven

Timeline

Published Mar 15, 2022
Tracked Since Feb 18, 2026