CVE-2022-27217: Medium severity vmware vrealize automation vulnerability
Jenkins Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-27217?
CVE-2022-27217 is classified as a high-severity vulnerability due to the exposure of sensitive information.
How do I fix CVE-2022-27217?
To fix CVE-2022-27217, update the Jenkins Vmware vRealize CodeStream Plugin to version 1.3 or later.
What data is compromised in CVE-2022-27217?
CVE-2022-27217 compromises passwords stored unencrypted in job config.xml files.
Who is affected by CVE-2022-27217?
Anyone using Jenkins with the Vmware vRealize CodeStream Plugin version 1.2 or earlier is affected by CVE-2022-27217.
What permissions are needed to exploit CVE-2022-27217?
Exploitation of CVE-2022-27217 requires users to have Extended Read permission or access to the Jenkins controller file system.