CVE-2023-43494
Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter values) from the search in the build history widget, allowing attackers with Item/Read…
Does this matter?
Lower severity and a low EPSS score (3.39%). Track it; it rarely justifies an emergency change on its own.
Description
Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter values) from the search in the build history widget, allowing attackers with Item/Read permission to obtain values of sensitive variables used in builds by iteratively testing different characters until the correct sequence is discovered.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 3.39% probability · 88th percentile
- CISA KEV
- Not listed
- Affected
- jenkins/jenkins
- Source
- jenkinsci-cert@googlegroups.com
References
- http://www.openwall.com/lists/oss-security/2023/09/20/5Mailing List, Third Party Advisory
- https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3261Vendor Advisory
- http://www.openwall.com/lists/oss-security/2023/09/20/5Mailing List, Third Party Advisory
- https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3261Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.