Jenkins Reverse Proxy Auth Plugin vulnerable due to plaintext storage of passwords

보통 6.5CVE-2022-45384 · GHSA-wcjj-qm5v-j4pc · Published 15/11/2022 · updated 17/06/2026

요약

CVE-2022-45384은(는) org.jenkins-ci.main:reverse-proxy-auth-plugin, reverse proxy auth (jenkins)에 영향을 주는 보통 (CVSS 6.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.72%, 전체 취약점의 53.8%보다 높음.
조치: 1.7.4 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
org.jenkins-ci.main:reverse-proxy-auth-plugin Maven	`≥ 1.7.3, < 1.7.4`	`1.7.4`
reverse proxy auth jenkins	`< 1.7.4`	`1.7.4`

Description

Jenkins Reverse Proxy Auth Plugin versions 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.

NVD description

Jenkins Reverse Proxy Auth Plugin 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.

References

nvd.nist.gov/vuln/detail/CVE-2022-45384 · ADVISORY
jenkinsci/reverse-proxy-auth-plugin · PACKAGE
jenkins.io/security/advisory/2022-11-15 · WEB
openwall.com/lists/oss-security/2022/11/15/4 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free