CVE-2022-20621 Access key stored in plain text by Jenkins Metrics Plugin
Attackers with file system access can read unencrypted access keys from the Jenkins Metrics Plugin configuration file.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-20621?
CVE-2022-20621 is a medium-severity vulnerability in Jenkins Metrics Plugin, published on 12 Jan 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Jenkins Metrics Plugin 4.0.2.8 and earlier stores an access key unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Weakness: CWE-522
Which versions are affected by CVE-2022-20621?
4 open source packages ship an affected version, including org.jenkins-ci.plugins:metrics. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:metrics Maven | All versions | 4.0.2.7.1 |
org.jenkins-ci.plugins:metrics Maven | All versions | 4.0.2.7.1 |
org.jenkins-ci.plugins:metrics Maven | From 4.0.2.8 | 4.0.2.8.1 |
org.jenkins-ci.plugins:metrics Maven | From 4.0.2.8 | 4.0.2.8.1 |
Products include Jenkins Metrics.
How do I fix CVE-2022-20621?
Upgrade org.jenkins-ci.plugins:metrics to a fixed version for your release line: 4.0.2.7.1 or 4.0.2.8.1.
Is CVE-2022-20621 being exploited?
There is no known exploitation of CVE-2022-20621 in the wild and no public exploit code.
Sources
Also known as GHSA-gg9m-x3cg-69vh.