CVE-2022-34803: Plaintext Storage of a Password

July 1, 2022 (updated July 12, 2022)

Jenkins OpsGenie Plugin 1.9 and earlier stores API keys unencrypted in its global configuration file and in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission (config.xml), or access to the Jenkins controller file system.

References

github.com/advisories/GHSA-273c-fjw8-v2w8
nvd.nist.gov/vuln/detail/CVE-2022-34803
www.jenkins.io/security/advisory/2022-06-30/

Code Behaviors & Features

Detect and mitigate CVE-2022-34803 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →