Password stored in plain text by Jenkins Publish Over SSH Plugin

NIEDRIG 3.3CVE-2022-23114 · GHSA-r3rr-wph6-9638 · Published 12/01/2022 · updated 17/06/2026

Kurz gesagt

CVE-2022-23114 ist eine Schwachstelle (NIEDRIG (CVSS 3.3)) in org.jenkins-ci.plugins:publish-over-ssh, publish over ssh (jenkins).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.31%, höher als bei 23.6% aller Schwachstellen.
Abhilfe: auf 1.23 oder neuer aktualisieren.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:publish-over-ssh Maven	`< 1.23`	`1.23`
publish over ssh jenkins	`≤ 1.22`	No fix yet

Description

Jenkins Publish Over SSH Plugin 1.22 and earlier stores password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2022-23114 · ADVISORY
jenkinsci/publish-over-ssh-plugin commit 2b4b9b2 · WEB
jenkinsci/publish-over-ssh-plugin commit 70b7689 · WEB
jenkinsci/publish-over-ssh-plugin · PACKAGE
jenkinsci/publish-over-ssh-plugin release publish-over-ssh-1.23 · WEB
jenkins.io/security/advisory/2022-01-12 · WEB
openwall.com/lists/oss-security/2022/01/12/6 · WEB

Weitere Schwachstellen in org.jenkins-ci.plugins:publish-over-ssh

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:publish-over-ssh

Maven

< 1.23

1.23

publish over ssh

jenkins

≤ 1.22

No fix yet

Description

NVD description

Weitere Schwachstellen in org.jenkins-ci.plugins:publish-over-ssh

Alle anzeigen →