CVE-2022-34806: 
Java vulnerability analysis and mitigation

Jenkins Jigomerge Plugin 0.9 and earlier contains a security vulnerability identified as CVE-2022-34806. The vulnerability was discovered and reported by Long Nguyen from Viettel Cyber Security, and was publicly disclosed on June 30, 2022. This vulnerability affects all versions of the Jigomerge Plugin up to and including version 0.9 (Jenkins Advisory).

The vulnerability is classified as a plaintext storage of sensitive information issue with a Low severity CVSS rating. The plugin stores passwords unencrypted in job config.xml files on the Jenkins controller as part of its configuration (Jenkins Advisory).

The exposed passwords can be viewed by users who have either Item/Extended Read permission or access to the Jenkins controller file system. This could potentially lead to unauthorized access to systems or services if the exposed credentials are valid and not properly protected (Jenkins Advisory).

As of the advisory's publication date, there is no fix available for this vulnerability. Users should carefully consider the permissions granted to users who have Item/Extended Read access or file system access to the Jenkins controller (Jenkins Advisory).