VulnerabilityModified

CVE-2023-24440

Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.

MEDIUM 5.5EPSS 0.19%

Does this matter?

Lower severity and a low EPSS score (0.19%). Track it; it rarely justifies an emergency change on its own.

Description

Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.

CVSS 3.1: 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.19% probability · 9th percentile
CISA KEV: Not listed
Weakness: CWE-319
Affected: jenkins/jira pipeline steps
Source: jenkinsci-cert@googlegroups.com

References

https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2774Vendor Advisory
https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2774Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.