Jenkins Reverse Proxy Auth Plugin vulnerable due to plaintext storage of passwords

MEDIO 6.5CVE-2022-45384 · GHSA-wcjj-qm5v-j4pc · Published 15/11/2022 · updated 17/06/2026

En resumen

CVE-2022-45384 es una vulnerabilidad MEDIO (CVSS 6.5) que afecta a org.jenkins-ci.main:reverse-proxy-auth-plugin, reverse proxy auth (jenkins).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.72%, mayor que el 53.8% de las vulnerabilidades.
Solución: actualizar a 1.7.4 o posterior.

Package	Affected versions	Patched versions
org.jenkins-ci.main:reverse-proxy-auth-plugin Maven	`≥ 1.7.3, < 1.7.4`	`1.7.4`
reverse proxy auth jenkins	`< 1.7.4`	`1.7.4`

Description

Jenkins Reverse Proxy Auth Plugin versions 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.

NVD description

Jenkins Reverse Proxy Auth Plugin 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.

References

nvd.nist.gov/vuln/detail/CVE-2022-45384 · ADVISORY
jenkinsci/reverse-proxy-auth-plugin · PACKAGE
jenkins.io/security/advisory/2022-11-15 · WEB
openwall.com/lists/oss-security/2022/11/15/4 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free