CVE-2022-34805

MEDIUM

Jenkins Skype Notifier < 1.1.0 - Insufficiently Protected Credentials

Title source: rule

Description

Jenkins Skype notifier Plugin 1.1.0 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

References (1)

Scores

CVSS v3 6.5
EPSS 0.0056
EPSS Percentile 67.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Classification

CWE
CWE-522
Status published

Affected Products (2)

jenkins/skype_notifier < 1.1.0
org.jenkins-ci.plugins/skype-notifier Maven

Timeline

Published Jun 30, 2022
Tracked Since Feb 18, 2026