Medium severity · published Nov 15, 2022
CVE-2022-45384
Jenkins Reverse Proxy Auth Plugin 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by…
6.5
CVSS
0.7%
EPSS
No
On KEV
Description
Jenkins Reverse Proxy Auth Plugin 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JR
Jenkins Reverse Proxy Auth Plugin · Jenkins project
through 1.7.3 · source: vendor
RP
Reverse Proxy Auth · Jenkins
before 1.7.4 · source: NVD
Affected product
JR
Jenkins Reverse Proxy Auth Plugin
Jenkins project
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-45384
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-45384
Mailing List
http://www.openwall.com/lists/oss-security/2022/11/15/4
Vendor Advisory
https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2094
More from Jenkins Reverse Proxy Auth Plugin
8.8
CVE-2023-32987
A cross-site request forgery (CSRF) vulnerability in Jenkins Reverse Proxy Auth Plugin 1.7.4 and earlier allows attackers to connect to an attacker-specified LDAP server using…