Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS13Y2pqLXFtNXYtajRwY84AAv6V
Jenkins Reverse Proxy Auth Plugin vulnerable due to plaintext storage of passwords
Jenkins Reverse Proxy Auth Plugin versions 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.
Permalink: https://github.com/advisories/GHSA-wcjj-qm5v-j4pcJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13Y2pqLXFtNXYtajRwY84AAv6V
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 years ago
Updated: about 1 year ago
CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Percentage: 0.00065
EPSS Percentile: 0.29549
Identifiers: GHSA-wcjj-qm5v-j4pc, CVE-2022-45384
References:
- https://nvd.nist.gov/vuln/detail/CVE-2022-45384
- https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2094
- http://www.openwall.com/lists/oss-security/2022/11/15/4
- https://github.com/advisories/GHSA-wcjj-qm5v-j4pc
Affected Packages
maven:org.jenkins-ci.main:reverse-proxy-auth-plugin
Affected Version Ranges: >= 1.7.3, < 1.7.4Fixed in: 1.7.4