GitHub Advisoryadvisory · Maven

GHSA-wcjj-qm5v-j4pc Jenkins Reverse Proxy Auth Plugin vulnerable due to plaintext storage of passwords

MEDIUM Published 2022-11-16 Modified 2025-04-30 Official page ↗
Aliases
CVE-2022-45384
Ecosystem
Maven
Packages
org.jenkins-ci.main:reverse-proxy-auth-plugin
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-256, CWE-522
Reviewed
2022-11-21

Affected packages

• Maven org.jenkins-ci.main:reverse-proxy-auth-plugin: >= 1.7.3, < 1.7.4 → fixed in 1.7.4

Description

Jenkins Reverse Proxy Auth Plugin versions 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.

Related

Alias · CVE (1)

  • CVE-2022-45384 Jenkins Reverse Proxy Auth Plugin 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the… vulnerability

Weakness · CWE (2)

  • CWE-256 Plaintext Storage of a Password weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References