CVE-2022-27195

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-03-15 · updated 2026-06-17

Description

Jenkins Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Jenkins Parameterized Trigger Plugin, including password parameter values, in their `build.xml` files. These values are stored unencrypted and can be viewed by users with access to the Jenkins controller file system.

Affected products

Jenkins project Jenkins Parameterized Trigger Plugin: before 2.43.1 — fixed in 2.43.1

How to fix

Upgrade to a fixed version: Jenkins project Jenkins Parameterized Trigger Plugin 2.43.1. Check the vendor advisory for mitigations.

References

http://www.openwall.com/lists/oss-security/2022/03/15/2
https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2185
http://www.openwall.com/lists/oss-security/2022/03/15/2
https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2185

Get alerted when CVE-2022-27195 or the next vulnerability affects your stack