Jenkins Reverse Proxy Auth Plugin vulnerable due to plaintext storage of passwords
Date: 2022-11
Affected: maven/org.jenkins-ci.main:reverse-proxy-auth-plugin
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2022-45384
CVE-2022-45386
CVE-2022-45395
CVE-2022-45396
CVE-2022-45397
CVE-2022-45400
CWE: CWE-256
CWE-522
CWE-611
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Jenkins Reverse Proxy Auth Plugin versions 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.


Mitigations:

Architectural layers (MAESTRO):