Jenkins OpsGenie Plugin vulnerable to Cleartext Transmission of Sensitive Information

MEDIUM 4.3CVE-2022-34804 · GHSA-7r65-pjgv-h2h9 · Published 30/06/2022 · updated 17/06/2026

In short

CVE-2022-34804 is a MEDIUM (CVSS 4.3) vulnerability affecting org.jenkins-ci.plugins:opsgenie, opsgenie (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.43%, higher than 37.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:opsgenie Maven	`≤ 1.9`	No fix yet
opsgenie jenkins	`≤ 1.9`	No fix yet

Description

Jenkins OpsGenie Plugin 1.9 and earlier stores API keys unencrypted in its global configuration file com.opsgenie.integration.jenkins.OpsGenieNotifier.xml and in job config.xml files on the Jenkins controller as part of its configuration.

Additionally, they are transmitted in plain text as part of the respective configuration forms.

These API keys can be viewed by users with Item/Extended Read permission (job config.xml only) or access to the Jenkins controller file system (both).

As of publication of this advisory, there is no fix.

NVD description

Jenkins OpsGenie Plugin 1.9 and earlier transmits API keys in plain text as part of the global Jenkins configuration form and job configuration forms, potentially resulting in their exposure.

References

nvd.nist.gov/vuln/detail/CVE-2022-34804 · ADVISORY
jenkinsci/opsgenie-plugin · PACKAGE
jenkins.io/security/advisory/2022-06-30 · WEB

More vulnerabilities in org.jenkins-ci.plugins:opsgenie

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:opsgenie

Maven

≤ 1.9

No fix yet

opsgenie

jenkins

≤ 1.9

No fix yet

Description

Additionally, they are transmitted in plain text as part of the respective configuration forms.

These API keys can be viewed by users with Item/Extended Read permission (job config.xml only) or access to the Jenkins controller file system (both).

As of publication of this advisory, there is no fix.

NVD description

Jenkins OpsGenie Plugin 1.9 and earlier transmits API keys in plain text as part of the global Jenkins configuration form and job configuration forms, potentially resulting in their exposure.