Vulnerability Description
Jenkins Reverse Proxy Auth Plugin 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Reverse Proxy Auth | < 1.7.4 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2022/11/15/4Mailing ListThird Party Advisory
- https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2094Vendor Advisory
- http://www.openwall.com/lists/oss-security/2022/11/15/4Mailing ListThird Party Advisory
- https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2094Vendor Advisory
FAQ
What is CVE-2022-45384?
CVE-2022-45384 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Jenkins Reverse Proxy Auth Plugin 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by attackers with access...
How severe is CVE-2022-45384?
CVE-2022-45384 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-45384?
Check the references section above for vendor advisories and patch information. Affected products include: Jenkins Reverse Proxy Auth.