PT-2022-15857 · Jenkins · Jenkins Publish Over Ssh Plugin+1

Justin Philip + 2 · Published 2022-01-12 · Updated 2023-11-30 · CVE-2022-23114

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Publish Over SSH Plugin versions 1.22 and earlier

Description The issue allows passwords to be stored unencrypted in the global configuration file on the Jenkins controller. This can be viewed by users with access to the Jenkins controller file system.

Recommendations For Jenkins Publish Over SSH Plugin versions 1.22 and earlier, consider updating to a version that properly encrypts passwords in the global configuration file to prevent unauthorized access. As a temporary workaround, restrict access to the Jenkins controller file system to minimize the risk of password exposure.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2022-23114

GHSA-R3RR-WPH6-9638

Affected Products

Jenkins

Jenkins Publish Over Ssh Plugin

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2022-23114 · Security Note
• https://jenkins.io/security/advisory/2022-01-12/#SECURITY-2291 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23114 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r3rr-wph6-9638 · Vendor Advisory
• https://github.com/jenkinsci/publish-over-ssh-plugin/releases/tag/publish-over-ssh-1.23 · Note
• https://github.com/jenkinsci/publish-over-ssh-plugin/commit/70b7689bf6fc894f4dc6c0ff34dd72808840760e · Note
• https://github.com/jenkinsci/publish-over-ssh-plugin · Note
• https://github.com/jenkinsci/publish-over-ssh-plugin/commit/2b4b9b2dfab5c001669f9a74c0e6078b0a27b928 · Note
• https://t.me/cvenotify/25615 · Telegram Post
• https://t.me/cvenotify/61756 · Telegram Post
• https://t.me/cvenotify/25347 · Telegram Post
• http://openwall.com/lists/oss-security/2022/01/12/6 · Note