Password stored in plain text by Jenkins Publish Over SSH Plugin

BAJO 3.3CVE-2022-23114 · GHSA-r3rr-wph6-9638 · Published 12/01/2022 · updated 17/06/2026

En resumen

CVE-2022-23114 es una vulnerabilidad BAJO (CVSS 3.3) que afecta a org.jenkins-ci.plugins:publish-over-ssh, publish over ssh (jenkins).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.31%, mayor que el 23.6% de las vulnerabilidades.
Solución: actualizar a 1.23 o posterior.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:publish-over-ssh Maven	`< 1.23`	`1.23`
publish over ssh jenkins	`≤ 1.22`	No fix yet

Description

Jenkins Publish Over SSH Plugin 1.22 and earlier stores password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2022-23114 · ADVISORY
jenkinsci/publish-over-ssh-plugin commit 2b4b9b2 · WEB
jenkinsci/publish-over-ssh-plugin commit 70b7689 · WEB
jenkinsci/publish-over-ssh-plugin · PACKAGE
jenkinsci/publish-over-ssh-plugin release publish-over-ssh-1.23 · WEB
jenkins.io/security/advisory/2022-01-12 · WEB
openwall.com/lists/oss-security/2022/01/12/6 · WEB

Más vulnerabilidades de org.jenkins-ci.plugins:publish-over-ssh

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:publish-over-ssh

Maven

< 1.23

1.23

publish over ssh

jenkins

≤ 1.22

No fix yet

Description

NVD description

Más vulnerabilidades de org.jenkins-ci.plugins:publish-over-ssh

Ver todo →