AWS secrets displayed without masking by Jenkins S3 Explorer Plugin

MITTEL 5.3CVE-2022-43426 · GHSA-mf4p-wjrm-cmjp · Published 19/10/2022 · updated 17/06/2026

Kurz gesagt

CVE-2022-43426 ist eine Schwachstelle (MITTEL (CVSS 5.3)) in io.jenkins.plugins:s3explorer, s3 explorer (jenkins).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.63%, höher als bei 50.2% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
io.jenkins.plugins:s3explorer Maven	`≤ 1.0.8`	No fix yet
s3 explorer jenkins	`≤ 1.0.8`	No fix yet

Description

S3 Explorer Plugin stores AWS_SECRET_ACCESS_KEY in its global configuration file s3explorer.xml on the Jenkins controller as part of its configuration.

While this secret is stored encrypted on disk, in S3 Explorer Plugin 1.0.8 and earlier the global configuration form does not mask the AWS_SECRET_ACCESS_KEY form field, increasing the potential for attackers to observe and capture it.

NVD description

Jenkins S3 Explorer Plugin 1.0.8 and earlier does not mask the AWS_SECRET_ACCESS_KEY form field, increasing the potential for attackers to observe and capture it.

References

nvd.nist.gov/vuln/detail/CVE-2022-43426 · ADVISORY
jenkinsci/s3explorer-plugin · PACKAGE
jenkins.io/security/advisory/2022-10-19 · WEB
openwall.com/lists/oss-security/2022/10/19/3 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free