CVE-2022-29052

published 2022-04-12

CVE-2022-29052: Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins controller where they can…

Priority P4 21 medium 4.3 CVSS 3.1

AV N AC L PR L UI N S U C L I N A N

Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

Affected

25 ranges

Vendor	Product	Version range	Fixed in
jenkins	build_step_plugin	—	—
jenkins	coordinator_plugin	—	—
jenkins	credentials_plugin	—	—
jenkins	cvs_plugin	—	—
jenkins	deprecated_groovy_libraries_plugin	—	—
jenkins	extended_choice_parameter_plugin	—	—
jenkins	gerrit_trigger_plugin	—	—
jenkins	git_parameter_plugin	—	—
jenkins	google_compute_engine	<= 4.3.8	—
jenkins	google_compute_engine_plugin	—	—
jenkins	input_step_plugin	—	—
jenkins	jira_plugin	—	—
jenkins	job_dsl_plugin	—	—
jenkins	job_generator_plugin	—	—
jenkins	mask_passwords_plugin	—	—
jenkins	maven_release_plugin	—	—
jenkins	node_and_label_parameter_plugin	—	—
jenkins	promotion_names_in_promoted_builds_plugin	—	—
jenkins	publish_over_ftp_plugin	—	—
jenkins	rebuilder_plugin	—	—
jenkins	release_plugin	—	—
jenkins	show_build_parameters_plugin	—	—
jenkins	subversion_plugin	—	—
jenkins	unleash_maven_plugin	—	—
jenkins_project	jenkins_google_compute_engine_plugin	unspecified – 4.3.8	—

CVSS provenance

nvd v3.1 4.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

nvd v2.0 4.0 MEDIUM AV:N/AC:L/Au:S/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-522