Not rated
CVE-2022-27195 Jenkins Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using…
Description
Jenkins Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Jenkins Parameterized Trigger Plugin, including password parameter values, in their `build.xml` files. These values are stored unencrypted and can be viewed by users with access to the Jenkins controller file system.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins Parameterized Trigger Plugin 2.43 | earliest → 2.43 | No fix stated |
| Jenkins Parameterized Trigger Plugin 2.41 | earliest → < 2.41.1 | 2.41.1 |
| Jenkins Parameterized Trigger Plugin 2.40 | earliest → < 2.40.1 | 2.40.1 |