Password stored in plain text by Jenkins Publish Over SSH Plugin

BASSO 3.3CVE-2022-23114 · GHSA-r3rr-wph6-9638 · Published 12/01/2022 · updated 17/06/2026

In breve

CVE-2022-23114 è una vulnerabilità BASSO (CVSS 3.3) che riguarda org.jenkins-ci.plugins:publish-over-ssh, publish over ssh (jenkins).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.31%, superiore al 23.6% delle vulnerabilità.
Correzione: aggiornare a 1.23 o successiva.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:publish-over-ssh Maven	`< 1.23`	`1.23`
publish over ssh jenkins	`≤ 1.22`	No fix yet

Description

Jenkins Publish Over SSH Plugin 1.22 and earlier stores password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2022-23114 · ADVISORY
jenkinsci/publish-over-ssh-plugin commit 2b4b9b2 · WEB
jenkinsci/publish-over-ssh-plugin commit 70b7689 · WEB
jenkinsci/publish-over-ssh-plugin · PACKAGE
jenkinsci/publish-over-ssh-plugin release publish-over-ssh-1.23 · WEB
jenkins.io/security/advisory/2022-01-12 · WEB
openwall.com/lists/oss-security/2022/01/12/6 · WEB

Altre vulnerabilità di org.jenkins-ci.plugins:publish-over-ssh

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:publish-over-ssh

Maven

< 1.23

1.23

publish over ssh

jenkins

≤ 1.22

No fix yet

Description

NVD description

Altre vulnerabilità di org.jenkins-ci.plugins:publish-over-ssh

Vedi tutto →