CVE-2022-20621: Access key stored in plain text by Jenkins Metrics Plugin
Summary
CVE-2022-20621: Access key stored in plain text by Jenkins Metrics Plugin. Affects org.jenkins-ci.plugins:metrics across 2 version ranges.
< 4.0.2.7.1
>= 4.0.2.8, < 4.0.2.8.1
Fixed in 4.0.2.7.1 or 4.0.2.8.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Jenkins Metrics Plugin is a Maven package that provides metrics and analytics capabilities for Jenkins, an open-source automation server. It allows users to monitor and analyze various aspects of their Jenkins environment. The plugin stores access keys in its global configuration file, jenkins.metrics.api.MetricsAccessKey.xml, on the Jenkins controller. Unfortunately, these access keys are stored in plain text, making them vulnerable to unauthorized access by users with file system access to the Jenkins controller.
Vulnerability Detail
The vulnerability in Jenkins Metrics Plugin allows users with file system access to the Jenkins controller to view the access keys stored in plain text. This can lead to unauthorized access to the metrics and analytics capabilities provided by the plugin. The access keys can be used by malicious actors to manipulate or extract sensitive information from the Jenkins environment. The vulnerability was assigned a CVSS score of 3.3, indicating a low severity level.
How To Fix
Latest published version: 4.2.37-494.v06f9a_939d33a_ as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.0.2.7.14.0.2.7.1 -
>= 4.0.2.8, < 4.0.2.8.14.0.2.8.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by restricting file system access to the Jenkins controller and ensuring that only authorized personnel have access to the configuration files.
Conclusion
The vulnerability in Jenkins Metrics Plugin allows unauthorized users with file system access to the Jenkins controller to view access keys stored in plain text. This can lead to unauthorized access to the metrics and analytics capabilities provided by the plugin. To mitigate this vulnerability, it is recommended to upgrade to the latest version of Metrics Plugin and restrict file system access to the Jenkins controller. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:metrics →
FAQ
Jenkins Metrics Plugin is a Maven package that provides metrics and analytics capabilities for Jenkins, an open-source automation server. It allows users to monitor and analyze various aspects of their Jenkins environment.
The vulnerability allows users with file system access to the Jenkins controller to view the access keys stored in plain text. This can lead to unauthorized access to the metrics and analytics capabilities provided by the plugin.
The vulnerability was assigned a CVSS score of 3.3, indicating a low severity level.
To fix this vulnerability, it is recommended to upgrade to Metrics Plugin version 4.0.2.8.1 or later. This version encrypts the access keys once the configuration is saved, providing an additional layer of security.
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by restricting file system access to the Jenkins controller and ensuring that only authorized personnel have access to the configuration files.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
