CVE-2022-34213

Overview

Jenkins Squash TM Publisher Plugin versions 1.0.0 and earlier stores passwords in plain text in its global configuration file on the Jenkins controller [1]. This violates secure credential storage practices.

Exploitation

An attacker with access to the Jenkins controller file system can read the configuration file to obtain stored passwords [3]. No additional authentication or network access is required.

Impact

Exposed passwords could be used to authenticate to Squash TM servers, potentially allowing unauthorized actions on test results and configurations managed through the plugin.

Mitigation

As of the advisory date, no fixed version was announced. Users should restrict file system access to the Jenkins controller and consider using encrypted credential stores if available. Monitor the plugin's repository for updates [2].