Password stored in plain text by Jenkins Publish Over SSH Plugin

LOW 3.3CVE-2022-23114 · GHSA-r3rr-wph6-9638 · Published 12/01/2022 · updated 17/06/2026

In short

CVE-2022-23114 is a LOW (CVSS 3.3) vulnerability affecting org.jenkins-ci.plugins:publish-over-ssh, publish over ssh (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.31%, higher than 23.6% of all vulnerabilities.
Fix: update to 1.23 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:publish-over-ssh Maven	`< 1.23`	`1.23`
publish over ssh jenkins	`≤ 1.22`	No fix yet

Description

Jenkins Publish Over SSH Plugin 1.22 and earlier stores password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2022-23114 · ADVISORY
jenkinsci/publish-over-ssh-plugin commit 2b4b9b2 · WEB
jenkinsci/publish-over-ssh-plugin commit 70b7689 · WEB
jenkinsci/publish-over-ssh-plugin · PACKAGE
jenkinsci/publish-over-ssh-plugin release publish-over-ssh-1.23 · WEB
jenkins.io/security/advisory/2022-01-12 · WEB
openwall.com/lists/oss-security/2022/01/12/6 · WEB

More vulnerabilities in org.jenkins-ci.plugins:publish-over-ssh

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:publish-over-ssh

Maven

< 1.23

1.23

publish over ssh

jenkins

≤ 1.22

No fix yet

Description

NVD description

More vulnerabilities in org.jenkins-ci.plugins:publish-over-ssh

See all →