Description

Jenkins Katalon Plugin 1.0.32 and earlier stores API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

Remediation

References

https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2846

http://www.openwall.com/lists/oss-security/2022/10/19/3

Related Vulnerabilities

CVE-2019-1003085 Vulnerability in maven package org.jenkins-ci.plugins:zephyr-enterprise-test-management

CVE-2022-34200 Vulnerability in maven package com.convertigo.jenkins.plugins:convertigo-mobile-platform

CVE-2019-5786 Vulnerability in npm package puppeteer

CVE-2022-24839 Vulnerability in maven package net.sourceforge.nekohtml:nekohtml

CVE-2021-26117 Vulnerability in maven package org.apache.activemq:activemq-jaas

Severity

High

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Vendor Advisory Mailing List Third Party Advisory