Jenkins Reverse Proxy Auth Plugin Vulnerability Exposing LDAP Manager Password
CVE-2022-45384

6.5MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Reverse Proxy Auth Plugin
Vendor
CVE Published:
15 November 2022

Summary

The Jenkins Reverse Proxy Auth Plugin versions 1.7.3 and earlier contain a vulnerability wherein the LDAP manager password is stored unencrypted in the global config.xml file. This configuration file is accessible on the Jenkins controller, presenting a risk to sensitive information, as attackers with file system access can potentially retrieve the plaintext password. It is essential for users to update to a secure version to mitigate this risk.

Affected Version(s)

Jenkins Reverse Proxy Auth Plugin <= 1.7.3

References

https://www.jenkins.io/security/advisory/2022-11-15/#SECU...
http://www.openwall.com/lists/oss-security/2022/11/15/4
mailing-list

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.