Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not mask the HashiCorp Consul ACL Token on the global configuration form, increasing the potential for attackers to observe and capture it.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2023/04/13/3 | Mailing List Third Party Advisory |
| https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2944 | Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2023/04/13/3 | Mailing List Third Party Advisory |
| https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2944 | Vendor Advisory |
Configurations
History
21 Nov 2024, 08:00
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.openwall.com/lists/oss-security/2023/04/13/3 - Mailing List, Third Party Advisory | |
| References | () https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2944 - Vendor Advisory |
Information
Published : 2023-04-12 18:15
Updated : 2024-11-21 08:00
NVD link : CVE-2023-30531
Mitre link : CVE-2023-30531
CVE.ORG link : CVE-2023-30531
JSON object : View
Products Affected
jenkins
- consul_kv_builder
CWE
CWE-312
Cleartext Storage of Sensitive Information