GitHub Advisoryadvisory · Maven

GHSA-x75r-g63m-82wj Passwords stored in plain text by Jenkins dbCharts Plugin

MEDIUM Published 2022-03-16 Modified 2023-10-27 Official page ↗
Aliases
CVE-2022-27216
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:dbCharts
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-522
Reviewed
2022-11-30

Affected packages

• Maven org.jenkins-ci.plugins:dbCharts: <= 0.5.2 (no fix yet)

Description

Jenkins dbCharts Plugin 0.5.2 and earlier stores JDBC connection passwords unencrypted in its global configuration file `hudson.plugins.dbcharts.DbChartPublisher.xml` on the Jenkins controller as part of its configuration. These passwords can be viewed by users with access to the Jenkins controller file system.

Related

Alias · CVE (1)

  • CVE-2022-27216 Jenkins dbCharts Plugin 0.5.2 and earlier stores JDBC connection passwords unencrypted in its global configuration file on the Jenkins… vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References