jenkins reverse proxy auth vulnerabilities

Latest jenkins reverse proxy auth CVEs

Newest publication first

1. CVE-2023-32987 Jenkins Reverse Proxy Auth Plugin cross-site request forgery vulnerability

   Published 2023-05-16

   High·CVSS 8.8 EPSS 0.45%

   A cross-site request forgery (CSRF) vulnerability in Jenkins Reverse Proxy Auth Plugin 1.7.4 and earlier allows attackers to connect to an attacker-specified LDAP server using attacker-specified credentials.

2. CVE-2022-45384 Jenkins Reverse Proxy Auth Plugin vulnerable due to plaintext storage of passwords

   Published 2022-11-15

   Medium·CVSS 6.5 EPSS 0.80%

   Jenkins Reverse Proxy Auth Plugin 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.

3. CVE-2018-1000150 Jenkins Reverse Proxy Auth Plugin allows attackers with local file system access to obtain a list of authorities for logged in users

   Published 2018-04-05

   Low·CVSS 3.3 EPSS 0.34%

   An exposure of sensitive information vulnerability exists in Jenkins Reverse Proxy Auth Plugin 1.5 and older in ReverseProxySecurityRealm#authContext that allows attackers with local file system access to obtain a list of authorities for logged in users.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.