Lucene search
HistoryNov 15, 2022 - 8:15 p.m.
CVE-2022-45384
jenkins
reverse proxy
auth plugin
ldap
unencrypted
config.xml
file system
security vulnerability
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
28.4%
Jenkins Reverse Proxy Auth Plugin 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.
Affected configurations
Node
jenkinsreverse_proxy_authRange<1.7.4jenkins
Related
github
github
cvelist
cvelist
CVE-2022-45384
2022-11-15 00:00:00
cve
cve
CVE-2022-45384
2022-11-15 20:15:11
osv
osv
Jenkins Reverse Proxy Auth Plugin vulnerable due to plaintext storage of passwords
2022-11-16 12:00:23
CVE-2022-45384
2022-11-15 20:15:11
prion
prion
Design/Logic Flaw
2022-11-15 20:15:00
nessus
nessus
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
28.4%
Related for NVD:CVE-2022-45384