CVE-2022-34816 - Jenkins HPE Network Virtualization Plugin 1.0 stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system

Back Back to CVE browser

MEDIUM

Jenkins HPE Network Virtualization Plugin 1.0 stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system

Published Jun 30, 2022

6.5

MEDIUM

CVSS 3.1

EPSS 0.73%

Description

Jenkins HPE Network Virtualization Plugin 1.0 stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

Affected products

Vendor Jenkins project Product Jenkins HPE Network Virtualization Plugin Default
unknown
Affected
- 1.0

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Jenkins project	Jenkins HPE Network Virtualization Plugin	unknown	Affected 1.0

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-256

CWE-522

Insufficiently Protected Credentials

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6213
Advisory
https://github.com/advisories/GHSA-36j8-f33j-vjwq
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-34816
https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2080
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6213		Advisory
https://github.com/advisories/GHSA-36j8-f33j-vjwq		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-34816
https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2080		x_refsource_CONFIRMVendor Advisory