CVE-2022-41255

6.5 mediumEPSS 0.8%

Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
CWE: CWE-522
Published: 2022-09-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

jenkins:cons3rt

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-fmq9-r4p2-8272	Maven	org.jenkins-ci.plugins:cons3rt	<=1.0.0	no fix published

References

http://www.openwall.com/lists/oss-security/2022/09/21/5
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2759
http://www.openwall.com/lists/oss-security/2022/09/21/5
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2759

Check your stack JSON