SB2022102130 - Missing Password Field Masking in Jenkins S3 Explorer plugin

Description

This security bulletin contains information about 1 vulnerability.

1) Missing Password Field Masking (CVE-ID: CVE-2022-43426)

CWE-ID: CWE-549 - Missing Password Field Masking

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the affected plugin stores AWS_SECRET_ACCESS_KEY in its global configuration file s3explorer.xml on the Jenkins controller as part of its configuration. A remote attacker can observe and capture it.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2480
• http://www.openwall.com/lists/oss-security/2022/10/19/3