1. Home
  2. Security Advisories
  3. Jenkins
  4. JENKINS:SECURITY-1624

[JENKINS:SECURITY-1624] Access key stored in plain text by `metrics`

Severity Low
Affected Packages 2
Fixed Packages 2
CVEs 1
Info Packages References Vulnerabilities

metrics 4.0.2.8 and earlier stores access keys unencrypted in its global configuration file jenkins.metrics.api.MetricsAccessKey.xml on the Jenkins controller as part of its configuration.

This access key can be viewed by users with access to the Jenkins controller file system.

metrics 4.0.2.8.1 stores access key encrypted once its configuration is saved again.

Additionally, the token value is only displayed once when it is generated.

Package Affected Version
pkg:maven/org.jenkins-ci.plugins/metrics <= 4.0.2.8
pkg:github/jenkinsci/metrics-plugin <= 4.0.2.8
Package Fixed Version
pkg:maven/org.jenkins-ci.plugins/metrics = 4.0.2.8.1
pkg:github/jenkinsci/metrics-plugin = 4.0.2.8.1
ID
JENKINS:SECURITY-1624
Severity
low
Published
2022-01-12T00:00:00
(2 years ago)
Modified
2022-01-12T00:00:00
(2 years ago)
Rights
Jenkins Security Team
Other Advisories
Source # ID Name URL
Plugin repository metrics repository https://github.com/jenkinsci/metrics-plugin
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.jenkins-ci.plugins/metrics org.jenkins-ci.plugins metrics <= 4.0.2.8
Fixed pkg:maven/org.jenkins-ci.plugins/metrics org.jenkins-ci.plugins metrics = 4.0.2.8.1
Affected pkg:github/jenkinsci/metrics-plugin jenkinsci metrics-plugin <= 4.0.2.8
Fixed pkg:github/jenkinsci/metrics-plugin jenkinsci metrics-plugin = 4.0.2.8.1
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date