Jenkins Publish Over SSH Plugin 1.22 and earlier stores password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2022/01/12/6 | Mailing List Third Party Advisory |
| https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2291 | Vendor Advisory |
Configurations
History
18 Jan 2022, 19:49
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-522 | |
| CPE | cpe:2.3:a:jenkins:publish_over_ssh:*:*:*:*:*:jenkins:*:* | |
| References | (CONFIRM) https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2291 - Vendor Advisory | |
| References | (MLIST) http://www.openwall.com/lists/oss-security/2022/01/12/6 - Mailing List, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : 2.1
v3 : 3.3 |
12 Jan 2022, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
12 Jan 2022, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-01-12 20:15
Updated : 2024-02-04 22:08
NVD link : CVE-2022-23114
Mitre link : CVE-2022-23114
CVE.ORG link : CVE-2022-23114
JSON object : View
Products Affected
jenkins
- publish_over_ssh
CWE
CWE-522
Insufficiently Protected Credentials