CVE-2022-34809: Medium severity ibm rational quality manager (rqm) vulnerability
Jenkins RQM Plugin 2.8 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Other sources
RQM Plugin 2.8 and earlier stores a password unencrypted in its global configuration file net.praqma.jenkins.rqm.RqmBuilder.xml on the Jenkins controller as part of its configuration.
This password can be viewed by users with access to the Jenkins controller file system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-34809?
CVE-2022-34809 has been classified as a medium severity vulnerability due to the exposure of sensitive passwords.
How do I fix CVE-2022-34809?
To fix CVE-2022-34809, users should upgrade to Jenkins RQM Plugin version 2.9 or later where the issue has been addressed.
What type of vulnerability is CVE-2022-34809?
CVE-2022-34809 is a security vulnerability related to the insecure storage of passwords in the configuration file.
Who is affected by CVE-2022-34809?
CVE-2022-34809 affects users of Jenkins RQM Plugin versions 2.8 and earlier.
Can CVE-2022-34809 lead to unauthorized access?
Yes, CVE-2022-34809 can potentially allow unauthorized users to view sensitive configuration details, including passwords.