CVE-2022-34804
First published: Thu Jun 30 2022(Updated: )
Jenkins OpsGenie Plugin 1.9 and earlier stores API keys unencrypted in its global configuration file `com.opsgenie.integration.jenkins.OpsGenieNotifier.xml` and in job `config.xml` files on the Jenkins controller as part of its configuration. Additionally, they are transmitted in plain text as part of the respective configuration forms. These API keys can be viewed by users with Item/Extended Read permission (job `config.xml` only) or access to the Jenkins controller file system (both). As of publication of this advisory, there is no fix.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Opsgenie | <=1.9 | |
| maven/org.jenkins-ci.plugins:opsgenie | <=1.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-34804.
What is the severity level of CVE-2022-34804?
The severity level of CVE-2022-34804 is medium with a CVSS score of 4.3.
How does CVE-2022-34804 impact Jenkins OpsGenie Plugin?
CVE-2022-34804 allows API keys to be stored unencrypted and transmitted in plain text, potentially exposing sensitive information.
Which versions of Jenkins OpsGenie Plugin are affected by CVE-2022-34804?
Jenkins OpsGenie Plugin versions 1.9 and earlier are affected by CVE-2022-34804.
How can I fix CVE-2022-34804?
To fix CVE-2022-34804, update Jenkins OpsGenie Plugin to a version later than 1.9 that addresses the vulnerability and reconfigure any exposed API keys.
- collector/nvd-index
- collector/github-advisory-latest
- alias/GHSA-7r65-pjgv-h2h9
- alias/CVE-2022-34804
- collector/nvd-cve
- collector/github-advisory
- collector/nvd-api
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/references
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/event
- agent/description
- agent/first-publish-date
- agent/tags
- agent/trending
- vendor/jenkins
- canonical/jenkins opsgenie
- version/jenkins opsgenie/1.9
- package-manager/maven