CVE-2022-23114 json
Password stored in plain text by Jenkins Publish Over SSH Plugin
published 2022-01-12 4 y ago modified 2026-06-17 4 mo ago also GHSA-r3rr-wph6-9638 , EUVD-2022-0680
- cvss
- 3.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 24%
- public exploits
- 0
- none known
Summary
Jenkins Publish Over SSH Plugin 1.22 and earlier stores password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Patch / fix
- maven org.jenkins-ci.plugins:publish-over-ssh 1.23
Exploit prediction
0.32% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 3.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.1 | 3.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:publish-over-ssh | <1.23 |
1.23 |
Affected products
- Jenkins project Jenkins Publish Over SSH Plugin
Classification
- Weakness
-
- CWE-522 Insufficiently Protected Credentials
References
-
github.com
/jenkinsci/publish-over-ssh-plugin/commit/2b4b9b2dfab5c001669f9a74c0e6078b0a27b928
web
-
github.com
/jenkinsci/publish-over-ssh-plugin/commit/70b7689bf6fc894f4dc6c0ff34dd72808840760e
web
-
jenkins.io
/security/advisory/2022-01-12/#SECURITY-2291
web, vendor-advisory
-
openwall.com
/lists/oss-security/2022/01/12/6
mailing-list, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-23114
advisory
-
github.com
/jenkinsci/publish-over-ssh-plugin
package
-
github.com
/jenkinsci/publish-over-ssh-plugin/releases/tag/publish-over-ssh-1.23
web
Sources
- CVE List CVE-2022-23114
- GitHub Advisory GHSA-r3rr-wph6-9638
- NVD CVE-2022-23114
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.