Jenkins Reverse Proxy Auth Plugin Vulnerability Exposing LDAP Manager Password

CVE-2022-45384

What is CVE-2022-45384?

The Jenkins Reverse Proxy Auth Plugin versions 1.7.3 and earlier contain a vulnerability wherein the LDAP manager password is stored unencrypted in the global config.xml file. This configuration file is accessible on the Jenkins controller, presenting a risk to sensitive information, as attackers with file system access can potentially retrieve the plaintext password. It is essential for users to update to a secure version to mitigate this risk.

References