CVE-2022-41255: Medium severity Jenkins Cons3rt Jenkins vulnerability
Published Sep 21, 2022
·Updated
Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Affected Software
1 affected component
Jenkins Cons3rt Jenkins<=1.0.0
Event History
Sep 21, 2022
CVE Published
via MITRE·03:46 PM
Data Sourced
via MITRE·03:46 PM
Description
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2022-41255?
CVE-2022-41255 has been rated as a Medium severity vulnerability.
2
How do I fix CVE-2022-41255?
To fix CVE-2022-41255, upgrade the Jenkins CONS3RT Plugin to version 1.0.1 or later.
3
What does CVE-2022-41255 affect?
CVE-2022-41255 affects Jenkins CONS3RT Plugin versions 1.0.0 and earlier.
4
What type of vulnerability is CVE-2022-41255?
CVE-2022-41255 is a security vulnerability that involves unencrypted storage of sensitive API tokens.
5
Can users access the vulnerable API tokens in CVE-2022-41255?
Yes, users with access to the Jenkins controller file system can view the unencrypted API tokens affected by CVE-2022-41255.