CVE-2022-34202: Medium severity jenkins vulnerability
Jenkins EasyQA Plugin 1.0 and earlier stores user passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-34202?
CVE-2022-34202 has a medium severity rating due to the risk of unauthorized access to sensitive user passwords.
How do I fix CVE-2022-34202?
To fix CVE-2022-34202, upgrade the Jenkins EasyQA Plugin to version 1.1 or later, which resolves the unencrypted password storage issue.
What are the risks associated with CVE-2022-34202?
The risks associated with CVE-2022-34202 include potential exposure of user passwords to any user with file system access to the Jenkins controller.
Which versions of Jenkins EasyQA are affected by CVE-2022-34202?
CVE-2022-34202 affects Jenkins EasyQA Plugin version 1.0 and earlier.
What should I do if I cannot upgrade to a fixed version of Jenkins EasyQA due to compatibility issues?
If you cannot upgrade, you should implement strict file system permissions to limit access to the Jenkins controller configuration file.