Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2022-27217
CVE-2022-27217:
Java vulnerability analysis and mitigation
Overview
CVE-2022-27217 affects the Jenkins Vmware vRealize CodeStream Plugin versions 1.2 and earlier. The vulnerability was discovered by Kevin Guerroudj and disclosed on March 15, 2022. This security issue involves the insecure storage of passwords in unencrypted format within job configuration files on the Jenkins controller (Jenkins Advisory, NVD).
Technical details
The vulnerability has a CVSS v3.1 Base Score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The technical issue stems from the plugin storing passwords in plaintext format within job config.xml files on the Jenkins controller as part of its configuration (Jenkins Advisory).
Impact
The vulnerability allows passwords to be viewed by users who have either Item/Extended Read permission or access to the Jenkins controller file system. This exposure of credentials could potentially lead to unauthorized access to connected systems and services (Jenkins Advisory).
Mitigation and workarounds
As of the advisory publication date, there was no fix available for this vulnerability. Users should carefully restrict access to both the Jenkins controller file system and limit the assignment of Item/Extended Read permissions (Jenkins Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management