CVE-2022-34806: Plaintext Storage of a Password in Jenkins Jigomerge Plugin
Summary
CVE-2022-34806: Plaintext Storage of a Password in Jenkins Jigomerge Plugin. Affects org.jenkins-ci.plugins:jigomerge versions < 0.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Jigomerge Plugin is a Maven-based plugin that is used in the Jenkins continuous integration and delivery system. It provides functionality for merging multiple Jenkins job configurations into a single job. The plugin allows users to define and manage job configurations, including sensitive information such as passwords. However, versions 0.9 and earlier of the plugin have a vulnerability that results in the plaintext storage of passwords in the job config.xml files on the Jenkins controller. This means that users with Extended Read permission or access to the Jenkins controller file system can view these passwords.
Vulnerability Detail
The vulnerability in the Jenkins Jigomerge Plugin allows passwords to be stored in an unencrypted format in the job config.xml files. This means that anyone with the necessary permissions or access to the Jenkins controller can view these passwords. The impact of this vulnerability is that sensitive information, such as credentials or API keys, can be easily accessed by unauthorized users. The vulnerability has a CVSS score of 3.3, indicating a low severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can manually encrypt passwords before storing them in the job configurations. This can be done using encryption libraries or tools provided by the Jenkins platform. By encrypting the passwords, even if the job config.xml files are accessed, the passwords will be unreadable. However, this workaround requires additional effort and may not be feasible for all users.
Conclusion
The Jenkins Jigomerge Plugin has a vulnerability that allows passwords to be stored in plaintext in job config.xml files. This can lead to unauthorized access to sensitive information. To mitigate this vulnerability, it is recommended to upgrade to a non-affected version of the plugin and ensure proper access controls are in place. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:jigomerge →
FAQ
The vulnerability allows unauthorized users to view passwords stored in the job config.xml files, potentially exposing sensitive information.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply enter your pom.xml file and the playground will provide real-time alerts for open-source vulnerabilities, including this one.
Yes, it is recommended to upgrade to a version of the Jenkins Jigomerge Plugin that is not affected by this issue. The latest version should have the necessary security measures in place to encrypt passwords and protect sensitive information.
Yes, as a workaround, you can manually encrypt passwords before storing them in the job configurations. This can be done using encryption libraries or tools provided by the Jenkins platform.
Users with Extended Read permission or access to the Jenkins controller file system can view the passwords stored in the job config.xml files.
