CVE-2022-45384

Summary

Jenkins Reverse Proxy Auth Plugin 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.

Affected Software

Weaknesses

ADP Enrichment

CVE Program Container

Additional References

• https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2094
• http://www.openwall.com/lists/oss-security/2022/11/15/4

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2094
• http://www.openwall.com/lists/oss-security/2022/11/15/4

• ←Previous
• Next→