CVE-2022-41255

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins CONS3RT Plugin	>= unspecified, <= 1.0.0

References

http://www.openwall.com/lists/oss-security/2022/09/21/5Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2759Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/09/21/5Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2759Vendor Advisory

Timeline

Published: Sep 21, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-412586.5Due to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker to inject malicious scrip CVE-2022-412596.5SAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate users from accessing a SQL Anywhere database server CVE-2022-41269.8Use of Default Password vulnerability in ABB RCCMD on Windows, Linux, MacOS allows Try Common or Default Usernames and Passwords.This issue CVE-2022-412606.1SAP Financial Consolidation - version 1010, does not sufficiently encode user-controlled input which may allow an unauthenticated attacker t CVE-2022-412615.5SAP Solution Manager (Diagnostic Agent) - version 7.20, allows an authenticated attacker on Windows system to access a file containing sensi CVE-2022-412626.1Due to insufficient input validation, SAP NetWeaver AS Java (HTTP Provider Service) - version 7.50, allows an unauthenticated attacker to in CVE-2022-412634.3Due to a missing authentication check, SAP Business Objects Business Intelligence Platform (Web Intelligence) - versions 420, 430, allows an CVE-2022-412648.8Due to the unrestricted scope of the RFC function module, SAP BASIS - versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, 7 CVE-2022-412666.1Due to a lack of proper input validation, SAP Commerce Webservices 2.0 (Swagger UI) - versions 1905, 2005, 2105, 2011, 2205, allows maliciou CVE-2022-412678.8SAP Business Objects Platform - versions 420, and 430, allows an attacker with normal BI user privileges to upload/replace any file on Busin CVE-2022-412687.5In some SAP standard roles in SAP Business Planning and Consolidation - versions - SAP_BW 750, 751, 752, 753, 754, 755, 756, 757, DWCORE 200 CVE-2022-41275.5A NULL pointer dereference issue was discovered in the Linux kernel in io_files_update_with_index_alloc. A local user could use this flaw to