Unprotected storage of credentials in CollabNets - CVE-2022-38665

Vulnerability details

The vulnerability allows a local user to gain access to other users' credentials.

The vulnerability exists due to the affected plugin stores a RabbitMQ password unencrypted in its global configuration file hudson.plugins.collabnet.share.TeamForgeShare.xml on the Jenkins controller as part of its configuration. A local user can view contents of the configuration file and gain access to passwords for 3rd party integration.

Affected software

How to mitigate CVE-2022-38665

External References

• https://www.jenkins.io/security/advisory/2022-08-23/#SECURITY-2157
• http://www.openwall.com/lists/oss-security/2022/08/23/2

Related Security Bulletins

• Unprotected storage of credentials in Jenkins CollabNet plugin