CVE-2022-27217

MEDIUM

Jenkins Vmware vRealize CodeStream < 1.2 - Insufficiently Protected Credentials in Job Config Files

Title source: llm

Description

Jenkins Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_confirm

https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2238

Mailing List, Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2022/03/15/2

Scores

CVSS v3 6.5

EPSS 0.0005

EPSS Percentile 14.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-522

Status published

Products (2)

com.vmware.vcac/vmware-vrealize-codestream 0Maven

jenkins/vmware_vrealize_codestream < 1.2

Published Mar 15, 2022

Tracked Since Feb 18, 2026