API token stored in plain text by Jenkins CONS3RT Plugin

MÉDIO 6.5CVE-2022-41255 · GHSA-fmq9-r4p2-8272 · Published 21/09/2022 · updated 17/06/2026

Em resumo

CVE-2022-41255 é uma vulnerabilidade MÉDIO (CVSS 6.5) que afeta org.jenkins-ci.plugins:cons3rt, cons3rt (jenkins).
Chance de exploração nos próximos 30 dias (EPSS): 0.81%, maior que 57.1% das vulnerabilidades.
Ainda não há versão corrigida: acompanhe o aviso do fornecedor em Referências.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:cons3rt Maven	`≤ 1.0.0`	No fix yet
cons3rt jenkins	`≤ 1.0.0`	No fix yet

Description

Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller as part of its configuration.

This API token can be viewed by users with access to the Jenkins controller file system.

NVD description

Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

References

nvd.nist.gov/vuln/detail/CVE-2022-41255 · ADVISORY
jenkinsci/cons3rt-plugin · PACKAGE
jenkins.io/security/advisory/2022-09-21 · WEB
openwall.com/lists/oss-security/2022/09/21/5 · WEB

Mais vulnerabilidades de org.jenkins-ci.plugins:cons3rt

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:cons3rt

Maven

≤ 1.0.0

No fix yet

cons3rt

jenkins

≤ 1.0.0

No fix yet

Description

Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller as part of its configuration.

This API token can be viewed by users with access to the Jenkins controller file system.

NVD description

Mais vulnerabilidades de org.jenkins-ci.plugins:cons3rt

Ver tudo →