{"id":"CVE-2022-41255","state":"PUBLISHED","title":"Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller where it can be viewed by users with access to the J","description":"Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.","publishedAt":"2022-09-21T15:46:12.000Z","updatedAt":"2025-05-28T14:08:30.885Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"CISA-ADP"},"assigner":"jenkins","products":["Jenkins project Jenkins CONS3RT Plugin"],"affected":[{"vendor":"Jenkins project","product":"Jenkins CONS3RT Plugin","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"1.0.0","versionType":"custom"},{"version":"next of 1.0.0","status":"unknown","lessThan":"unspecified","versionType":"custom"}]}],"references":["https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2759","http://www.openwall.com/lists/oss-security/2022/09/21/5"],"weaknesses":["CWE-522"],"ingestedAt":"2026-10-29T19:50:37.819Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/41xxx/CVE-2022-41255.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-41255","state":"PUBLISHED","datePublished":"2022-09-21T15:46:12.000Z","dateUpdated":"2025-05-28T14:08:30.885Z","assignerShortName":"jenkins","assignerOrgId":"39769cd5-e6e2-4dc8-927e-97b3aa056f5b","dateReserved":"2022-09-21T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system."}],"affected":[{"vendor":"Jenkins project","product":"Jenkins CONS3RT Plugin","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"1.0.0","versionType":"custom"},{"version":"next of 1.0.0","status":"unknown","lessThan":"unspecified","versionType":"custom"}]}],"references":[{"url":"https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2759","tags":["x_refsource_CONFIRM"]},{"url":"http://www.openwall.com/lists/oss-security/2022/09/21/5","name":"[oss-security] 20220921 Multiple vulnerabilities in Jenkins and Jenkins plugins","tags":["mailing-list","x_refsource_MLIST"]}],"providerMetadata":{"shortName":"jenkins","orgId":"39769cd5-e6e2-4dc8-927e-97b3aa056f5b","dateUpdated":"2023-10-24T14:25:25.581Z"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"jenkinsci-cert@googlegroups.com","ID":"CVE-2022-41255","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Jenkins CONS3RT Plugin","version":{"version_data":[{"version_affected":"<=","version_value":"1.0.0"},{"version_affected":"?>","version_value":"1.0.0"}]}}]},"vendor_name":"Jenkins project"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-256: Plaintext Storage of a Password"}]}]},"references":{"reference_data":[{"name":"https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2759","refsource":"CONFIRM","url":"https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2759"},{"name":"[oss-security] 20220921 Multiple vulnerabilities in Jenkins and Jenkins plugins","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2022/09/21/5"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2759","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2022/09/21/5","name":"[oss-security] 20220921 Multiple vulnerabilities in Jenkins and Jenkins plugins","tags":["mailing-list","x_refsource_MLIST","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T12:42:44.074Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-05-28T14:07:56.391729Z","id":"CVE-2022-41255","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-522","type":"CWE","lang":"en","description":"CWE-522 Insufficiently Protected Credentials"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-28T14:08:30.885Z"}}]}}}