CVE-2022-45384

2022-11-1500:00:00

jenkins

www.cve.org

cve-2022-45384

jenkins

reverse proxy auth plugin

ldap

manager password

unencrypted

global config.xml

jenkins controller

file system

security vulnerability

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.4%

JSON

Jenkins Reverse Proxy Auth Plugin 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.

CNA Affected

[
  {
    "product": "Jenkins Reverse Proxy Auth Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "1.7.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]