Read the docs
TI-2022-10317 Aliases CVE-2022-27195GHSA-5mpf-hw8f-86w9

Sensitive information in log files in Jenkins Parameterized Trigger Plugin

Priority LOW 25CWE-532Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-532.

Summary

Jenkins Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Jenkins Parameterized Trigger Plugin, including password parameter values, in their `build.xml` files. These values are stored unencrypted and can be viewed by users with access to the Jenkins controller file system.

Why it matters now

EPSS 0.00383 32nd percentileScored 2026-11-07
Fix Partial Jenkins Parameterized Trigger Plugin (Jenkins project): 2.40.1, 2.41.1org.jenkins-ci.plugins:parameterized-trigger (Maven): 2.43.1Red Hat: 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins Parameterized Trigger Pluginup to 2.432.40.1, 2.41.1Patch availableCNA
—org.jenkins-ci.plugins:parameterized-trigger (Maven)before 2.43.12.43.1Patch availableGHSA-5mpf-hw8f-86w9
  • Jenkins Parameterized Trigger Plugin VendorJenkins Affected up to 2.43 Fixed in 2.40.1, 2.41.1 Patch available CNA
  • org.jenkins-ci.plugins:parameterized-trigger (Maven) Vendor— Affected before 2.43.1 Fixed in 2.43.1 Patch available GHSA-5mpf-hw8f-86w9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:parameterized_trigger:*:*:*:*:*:jenkins:*:*before 2.43.1VulnerableJenkins
  • cpe:2.3:a:jenkins:parameterized_trigger:*:*:*:*:*:jenkins:*:* Versions before 2.43.1 Vulnerable ·Jenkins

Remediation

  • Fix · CNA Jenkins Parameterized Trigger Plugin (Jenkins project) Fixed in 2.40.1, 2.41.1
  • Fix · GHSA-5mpf-hw8f-86w9 org.jenkins-ci.plugins:parameterized-trigger (Maven) Fixed in 2.43.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix yet

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-27195
  2. 2026-10-03 Alias added: GHSA-5mpf-hw8f-86w9

References

Advisory 3

Other 3

  • TI-2017-14421 Parameterized Trigger Plugin fails to check Item/Build permission: The Parameterized… CVSS 3.0MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences