CVE-2022-28135: Jenkins Instant-Messaging

Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days.

Jenkins instant-messaging Plugin 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins based on Jenkins instant-messaging Plugin on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

Affected products

• Jenkins Instant-Messaging: before 1.42 (fixed in 1.42)

Published 2022-03-29. Last modified 2026-06-17.