CVE-2022-34809: Password stored in plain text by Jenkins RQM Plugin
Summary
CVE-2022-34809: Password stored in plain text by Jenkins RQM Plugin. Affects net.praqma:rqm-plugin versions < 2.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins RQM Plugin is a Maven package (net.praqma:rqm-plugin) that integrates Jenkins with IBM Rational Quality Manager (RQM). It allows users to automate the execution of test cases and publish the results to RQM. The plugin is widely used in software development and testing processes to streamline the integration between Jenkins and RQM.
Vulnerability Detail
The RQM Plugin version 2.8 and earlier stores a password in plain text in its global configuration file net.praqma.jenkins.rqm.RqmBuilder.xml on the Jenkins controller. This means that the password is not encrypted or protected in any way. As a result, users with access to the Jenkins controller file system can view the password. This vulnerability poses a security risk as it exposes sensitive credentials to potential attackers.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can manually encrypt the password in the global configuration file to mitigate the risk. This can be done by using encryption techniques or tools available in the Jenkins environment. It is important to note that manual encryption may require additional configuration and maintenance efforts.
Conclusion
The Jenkins RQM Plugin version 2.8 and earlier stores passwords in plain text, posing a security risk. Users should upgrade to version 2.9 or later, which includes a fix for this vulnerability. It is also advisable to change the password stored in the global configuration file. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for net.praqma:rqm-plugin →
FAQ
This vulnerability exposes the password stored in the RQM Plugin's global configuration file to unauthorized users. Attackers with access to the Jenkins controller file system can view the password, potentially leading to unauthorized access to RQM and other connected systems.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file as input.
Yes, the CVSS score for this vulnerability is 3.3. It is considered a low-severity vulnerability.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to address the issue promptly to prevent potential unauthorized access to sensitive systems.
If you cannot immediately upgrade to the latest version of the RQM Plugin, it is recommended to manually encrypt the password in the global configuration file as a temporary measure. Additionally, restrict access to the Jenkins controller file system to authorized personnel only.
Related vulnerabilities
Recent vulnerabilities recorded for net.praqma:rqm-plugin.
