{"api_version":"1","generated_at":"2026-04-23T02:38:04+00:00","cve":"CVE-2022-23114","urls":{"html":"https://cve.report/CVE-2022-23114","api":"https://cve.report/api/cve/CVE-2022-23114.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-23114","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-23114"},"summary":{"title":"CVE-2022-23114","description":"Jenkins Publish Over SSH Plugin 1.22 and earlier stores password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.","state":"PUBLIC","assigner":"jenkinsci-cert@googlegroups.com","published_at":"2022-01-12 20:15:00","updated_at":"2023-11-30 18:42:00"},"problem_types":["CWE-522"],"metrics":[],"references":[{"url":"http://www.openwall.com/lists/oss-security/2022/01/12/6","name":"[oss-security] 20220112 Multiple vulnerabilities in Jenkins and Jenkins plugins","refsource":"MLIST","tags":[],"title":"oss-security - Multiple vulnerabilities in Jenkins and Jenkins plugins","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2291","name":"https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2291","refsource":"CONFIRM","tags":[],"title":"Jenkins Security Advisory 2022-01-12","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23114","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23114","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"23114","vulnerable":"1","versionEndIncluding":"1.22","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"jenkins","cpe5":"publish_over_ssh","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"jenkins","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2022-23114","qid":"376410","title":"Jenkins Plugins Multiple Security Vulnerabilities (Jenkins Security Advisory 2022-01-12)"}]},"source_records":{"cve_program":{"data_version":"4.0","data_type":"CVE","data_format":"MITRE","CVE_data_meta":{"ID":"CVE-2022-23114","ASSIGNER":"jenkinsci-cert@googlegroups.com","STATE":"PUBLIC"},"description":{"description_data":[{"lang":"eng","value":"Jenkins Publish Over SSH Plugin 1.22 and earlier stores password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"affects":{"vendor":{"vendor_data":[{"vendor_name":"Jenkins project","product":{"product_data":[{"product_name":"Jenkins Publish Over SSH Plugin","version":{"version_data":[{"version_value":"not down converted","x_cve_json_5_version_data":{"versions":[{"lessThanOrEqual":"1.22","status":"affected","version":"unspecified","versionType":"custom"},{"lessThan":"unspecified","status":"unknown","version":"next of 1.22","versionType":"custom"}]}}]}}]}}]}},"references":{"reference_data":[{"url":"https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2291","refsource":"MISC","name":"https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2291"},{"url":"http://www.openwall.com/lists/oss-security/2022/01/12/6","refsource":"MISC","name":"http://www.openwall.com/lists/oss-security/2022/01/12/6"}]}},"nvd":{"publishedDate":"2022-01-12 20:15:00","lastModifiedDate":"2023-11-30 18:42:00","problem_types":["CWE-522"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW"},"exploitabilityScore":1.8,"impactScore":1.4},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:N/A:N","accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":2.1},"severity":"LOW","exploitabilityScore":3.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:jenkins:publish_over_ssh:*:*:*:*:*:jenkins:*:*","versionEndIncluding":"1.22","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2022","CveId":"23114","Ordinal":"225725","Title":"CVE-2022-23114","CVE":"CVE-2022-23114","Year":"2022"},"notes":[{"CveYear":"2022","CveId":"23114","Ordinal":"1","NoteData":"Jenkins Publish Over SSH Plugin 1.22 and earlier stores password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.","Type":"Description","Title":null},{"CveYear":"2022","CveId":"23114","Ordinal":"2","NoteData":"2022-01-12","Type":"Other","Title":"Published"},{"CveYear":"2022","CveId":"23114","Ordinal":"3","NoteData":"2022-01-12","Type":"Other","Title":"Modified"}]}}}