CVE-2022-36901

Jenkins HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

• CWE-522

• http://www.openwall.com/lists/oss-security/2022/07/27/1Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2053Vendor Advisory
• http://www.openwall.com/lists/oss-security/2022/07/27/1Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2053Vendor Advisory

Published

Jul 27, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-36896A missing permission check in Jenkins Compuware Source Code …6.5
• CVE-2022-36897A missing permission check in Jenkins Compuware Xpediter Cod…4.3
• CVE-2022-36898A missing permission check in Jenkins Compuware ISPW Operati…4.3
• CVE-2022-36899Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier d…8.2
• CVE-2022-3690The Popup Maker WordPress plugin before 1.16.11 does not san…4.8
• CVE-2022-36900Jenkins Compuware zAdviser API Plugin 1.0.3 and earlier does…8.2
• CVE-2022-36902Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and e…5.4
• CVE-2022-36903A missing permission check in Jenkins Repository Connector P…4.3
• CVE-2022-36904Jenkins Repository Connector Plugin 2.2.0 and earlier does n…4.3
• CVE-2022-36905Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2…5.4
• CVE-2022-36906A cross-site request forgery (CSRF) vulnerability in Jenkins…6.5
• CVE-2022-36907A missing permission check in Jenkins OpenShift Deployer Plu…6.5