User passwords stored in plain text by Jenkins EasyQA Plugin

中危 6.5CVE-2022-34202 · GHSA-xcp5-j5fj-3xp6 · Published 23/06/2022 · updated 17/06/2026

要点

CVE-2022-34202 是影响 com.geteasyqa:easyqa, easyqa (jenkins) 的中危 (CVSS 6.5)漏洞。
未来 30 天内被利用的概率（EPSS）：0.72%，高于 54.1% 的漏洞。
暂无已修复版本：请关注参考资料中的厂商公告。

Package	Affected versions	Patched versions
com.geteasyqa:easyqa Maven	`≤ 1.0`	No fix yet
easyqa jenkins	`≤ 1.0`	No fix yet

Description

EasyQA Plugin 1.0 and earlier stores user passwords unencrypted in its global configuration file EasyQAPluginProperties.xml on the Jenkins controller as part of its configuration.

These passwords can be viewed by users with access to the Jenkins controller file system.

NVD description

Jenkins EasyQA Plugin 1.0 and earlier stores user passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

References

nvd.nist.gov/vuln/detail/CVE-2022-34202 · ADVISORY
jenkinsci/easyqa-plugin · PACKAGE
jenkins.io/security/advisory/2022-06-22 · WEB

com.geteasyqa:easyqa 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

com.geteasyqa:easyqa

Maven

≤ 1.0

No fix yet

easyqa

jenkins

≤ 1.0

No fix yet

Description

EasyQA Plugin 1.0 and earlier stores user passwords unencrypted in its global configuration file EasyQAPluginProperties.xml on the Jenkins controller as part of its configuration.

These passwords can be viewed by users with access to the Jenkins controller file system.

NVD description

com.geteasyqa:easyqa 的其他漏洞

查看全部 →