CVE-2022-34805: Plaintext Storage of a Password in Jenkins Skype notifier Plugin
Summary
CVE-2022-34805: Plaintext Storage of a Password in Jenkins Skype notifier Plugin. Affects org.jenkins-ci.plugins:skype-notifier versions < 1.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Skype notifier Plugin is a Maven package (org.jenkins-ci.plugins:skype-notifier) that provides functionality for sending notifications to Skype. It allows users to configure Skype credentials in the global configuration file hudson.plugins.skype.im.transport.SkypePublisher.xml on the Jenkins controller. However, versions 1.1.0 and earlier of the plugin store the password in plaintext, making it vulnerable to unauthorized access by users with file system access to the Jenkins controller.
Vulnerability Detail
The vulnerability (CVE-2022-34805) in the Jenkins Skype notifier Plugin arises from the insecure storage of passwords in its global configuration file. This file, hudson.plugins.skype.im.transport.SkypePublisher.xml, contains the password in plaintext, allowing any user with file system access to the Jenkins controller to view it. This can lead to unauthorized access to Skype accounts and potential misuse of the credentials. The vulnerability has a CVSS score of 3.3, indicating a low severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can mitigate the risk by restricting file system access to the Jenkins controller and regularly monitoring the system for any unauthorized access or suspicious activities.
Conclusion
The Jenkins Skype notifier Plugin (org.jenkins-ci.plugins:skype-notifier) versions 1.1.0 and earlier suffer from a vulnerability that allows the plaintext storage of passwords in its global configuration file. This can lead to unauthorized access to Skype accounts and potential misuse of the credentials. To mitigate this vulnerability, it is recommended to update the plugin to version 1.1.1 or later and restrict file system access to the Jenkins controller. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:skype-notifier →
FAQ
The vulnerability allows users with file system access to the Jenkins controller to view the Skype password stored in plaintext. This can lead to unauthorized access to Skype accounts and potential misuse of the credentials.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file, without requiring access to the code or installation.
The CVSS score of this vulnerability is 3.3, indicating a low severity level.
There are no known exploits for this vulnerability at the time of this report. However, it is important to apply the recommended fix to prevent any potential unauthorized access.
Yes, a patch is available for this vulnerability. Users should update the Jenkins Skype notifier Plugin to version 1.1.1 or later to fix the issue.
