GHSA-wcjj-qm5v-j4pc

ghsaUSosv

Jenkins Reverse Proxy Auth Plugin vulnerable due to plaintext storage of passwords

view advisory published 2022-11-16Licence: CC-BY-4.0

Jenkins Reverse Proxy Auth Plugin versions 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-45384US	medium6.5	0.72% (54th)	—	2022-11-15
Jenkins Reverse Proxy Auth Plugin 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by a…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2022/11/15/4WEB
https://github.com/jenkinsci/reverse-proxy-auth-pluginPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2022-45384ADVISORY
https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2094WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan