CVE-2022-45384: 
Java vulnerability analysis and mitigation

CVE-2022-45384 is a security vulnerability discovered in Jenkins Reverse Proxy Auth Plugin versions 1.7.3 and earlier, disclosed on November 15, 2022. The vulnerability relates to the insecure storage of LDAP manager passwords in plaintext within the Jenkins controller's global configuration file (Jenkins Advisory).

The vulnerability is classified with a Low severity CVSS score and is identified as CWE-256/CWE-522 (Plaintext Storage of Password). The core issue involves the Reverse Proxy Auth Plugin storing LDAP manager passwords in an unencrypted format within the global config.xml file on the Jenkins controller as part of its configuration (Jenkins Advisory, NVD).

The vulnerability exposes LDAP manager passwords to potential unauthorized access. Any attacker with access to the Jenkins controller file system could view these unencrypted passwords, potentially leading to unauthorized access to LDAP resources (Jenkins Advisory).

The vulnerability has been fixed in Reverse Proxy Auth Plugin version 1.7.4. After updating to this version, the LDAP manager password will be stored in an encrypted format once the configuration is saved again. Users are strongly advised to upgrade to this version to protect their LDAP manager credentials (Jenkins Advisory).