CVE-2022-20621: 
Java vulnerability analysis and mitigation

CVE-2022-20621 affects the Jenkins Metrics Plugin versions 4.0.2.8 and earlier. The vulnerability was discovered by Wasin Saengow and disclosed on January 12, 2022. This security issue involves the storage of access keys in an unencrypted format within the plugin's global configuration file on the Jenkins controller (Jenkins Advisory).

The vulnerability exists in the Metrics Plugin where access keys are stored unencrypted in the global configuration file 'jenkins.metrics.api.MetricsAccessKey.xml' on the Jenkins controller. The severity is rated as Low with a CVSS v3.1 base score of 5.5 MEDIUM (Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) (NVD).

The vulnerability allows users with access to the Jenkins controller file system to view the unencrypted access keys stored in the configuration file. This could potentially lead to unauthorized access to metrics data and related functionality (Jenkins Advisory).

The issue has been fixed in Metrics Plugin version 4.0.2.8.1. In the fixed version, the access key is stored encrypted once the configuration is saved again. Additionally, the token value is only displayed once when it is generated (Jenkins Advisory).