Password stored in plain text by Jenkins Publish Over SSH Plugin

BAIXO 3.3CVE-2022-23114 · GHSA-r3rr-wph6-9638 · Published 12/01/2022 · updated 17/06/2026

Em resumo

CVE-2022-23114 é uma vulnerabilidade BAIXO (CVSS 3.3) que afeta org.jenkins-ci.plugins:publish-over-ssh, publish over ssh (jenkins).
Chance de exploração nos próximos 30 dias (EPSS): 0.31%, maior que 23.6% das vulnerabilidades.
Correção: atualize para 1.23 ou posterior.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:publish-over-ssh Maven	`< 1.23`	`1.23`
publish over ssh jenkins	`≤ 1.22`	No fix yet

Description

Jenkins Publish Over SSH Plugin 1.22 and earlier stores password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2022-23114 · ADVISORY
jenkinsci/publish-over-ssh-plugin commit 2b4b9b2 · WEB
jenkinsci/publish-over-ssh-plugin commit 70b7689 · WEB
jenkinsci/publish-over-ssh-plugin · PACKAGE
jenkinsci/publish-over-ssh-plugin release publish-over-ssh-1.23 · WEB
jenkins.io/security/advisory/2022-01-12 · WEB
openwall.com/lists/oss-security/2022/01/12/6 · WEB

Mais vulnerabilidades de org.jenkins-ci.plugins:publish-over-ssh

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:publish-over-ssh

Maven

< 1.23

1.23

publish over ssh

jenkins

≤ 1.22

No fix yet

Description

NVD description

Mais vulnerabilidades de org.jenkins-ci.plugins:publish-over-ssh

Ver tudo →