Insufficiently protected credentials in Jenkins Metrics Plugin
Priority LOW 25CWE-522Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-522.
Summary
Jenkins Metrics Plugin 4.0.2.8 and earlier stores an access key unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Why it matters now
EPSS 0.00329 26th percentileScored 2026-11-07
Fix Partial Jenkins Metrics Plugin (Jenkins project): 4.0.2.7.1org.jenkins-ci.plugins:metrics (Maven): 4.0.2.8.1, 4.0.2.7.1Red Hat: 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Jenkins | Jenkins Metrics Plugin | up to 4.0.2.8 | 4.0.2.7.1 | Patch available | CNA |
| — | org.jenkins-ci.plugins:metrics (Maven) | 4.0.2.8 to before 4.0.2.8.1 | 4.0.2.8.1 | Patch available | GHSA-gg9m-x3cg-69vh |
| — | org.jenkins-ci.plugins:metrics (Maven) | before 4.0.2.7.1 | 4.0.2.7.1 | Patch available | GHSA-gg9m-x3cg-69vh |
- Jenkins Metrics Plugin VendorJenkins Affected up to 4.0.2.8 Fixed in 4.0.2.7.1 Patch available CNA
- org.jenkins-ci.plugins:metrics (Maven) Vendor— Affected 4.0.2.8 to before 4.0.2.8.1 Fixed in 4.0.2.8.1 Patch available GHSA-gg9m-x3cg-69vh
- org.jenkins-ci.plugins:metrics (Maven) Vendor— Affected before 4.0.2.7.1 Fixed in 4.0.2.7.1 Patch available GHSA-gg9m-x3cg-69vh
Remediation
- Fix · CNA Jenkins Metrics Plugin (Jenkins project) Fixed in 4.0.2.7.1
- Fix · GHSA-gg9m-x3cg-69vh org.jenkins-ci.plugins:metrics (Maven) Fixed in 4.0.2.8.1 Advisory →
- Fix · GHSA-gg9m-x3cg-69vh org.jenkins-ci.plugins:metrics (Maven) Fixed in 4.0.2.7.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
Timeline
- 2026-10-02 Threatist record created from CVE-2022-20621
- 2026-10-03 Alias added: GHSA-gg9m-x3cg-69vh
References
Advisory 3
Sources
- CVE-2022-20621 · CVE Program
- CVE-2022-20621 · NVD
- FIRST EPSS
- GHSA-gg9m-x3cg-69vh · GitHub Advisory Database · CC BY 4.0
- CVE-2022-20621 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences