cbcvebase.
CVE-2022-34199
published 2022-06-23

CVE-2022-34199: Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be…

PriorityP335medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.70%
52.8th percentile
Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

Affected

32 ranges· showing 25
VendorProductVersion rangeFixed in
jenkinsagent_server_parameter_plugin——
jenkinsbeaker_builder_plugin——
jenkinsconvertigo_mobile_platform<= 1.1—
jenkinsconvertigo_mobile_platform_plugin——
jenkinscrx_content_package_deployer_plugin——
jenkinsdate_parameter_plugin——
jenkinsdynamic_extended_choice_parameter_plugin——
jenkinseasyqa_plugin——
jenkinsembeddable_build_status_plugin——
jenkinsfilesystem_list_parameter_plugin——
jenkinshidden_parameter_plugin——
jenkinsimage_tag_parameter_plugin——
jenkinsimproper_authorization_in_embeddable_build_status_plugin——
jenkinsinput_step_plugin——
jenkinsjenkins_ci_server_plugin——
jenkinsjenkins_core——
jenkinsjenkins_lts——
jenkinsjenkins_weekly——
jenkinsjianliao_notification_plugin——
jenkinsjunit_plugin——
jenkinsmaven_metadata_plugin——
jenkinsnested_view_plugin——
jenkinsns-nd_integration_performance_publisher_plugin——
jenkinsorchestrator_plugin——
jenkinspackage_version_plugin——

CVSS provenance

nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.