Jenkins incapptic connect uploader Plugin 1.15 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

Affected Packages

Maven com.incapptic.plugins:incapptic-connect-uploader

Affected versions: 0 (last affected: 1.15)

Related CVEs

CVE-2022-27218

Key Information

GHSA ID

GHSA-8g9w-5jv6-7m4x

Published

March 16, 2022 12:00 AM

Last Modified

November 30, 2022 6:45 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

com.incapptic.plugins:incapptic-connect-uploader

GitHub Reviewed

✓ Yes

Dataset

Last updated: August 25, 2025 6:33 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.