CVE-2022-34799: Medium severity jenkins deployment dashboard plugin vulnerability
Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file de.codecentric.jenkins.dashboard.DashboardView.xml on the Jenkins controller as part of its configuration. This password can be viewed by users with access to the Jenkins controller file system.
Other sources
Jenkins Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-34799.
What is the title of the vulnerability?
The title of the vulnerability is 'Jenkins Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.'
What is the severity of CVE-2022-34799?
The severity of CVE-2022-34799 is medium, with a severity value of 4.3.
What software is affected by CVE-2022-34799?
The Jenkins Deployment Dashboard Plugin version 1.0.10 and earlier is affected by CVE-2022-34799.
How can the vulnerability be exploited?
The vulnerability, CVE-2022-34799, can be exploited by users with access to the Jenkins controller file system to view a password that is stored unencrypted in the global configuration file of the plugin.