CVE-2023-50770

Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a recoverable format, allowing attackers with access to the Jenkins controller file system to recover the plain text password of that account, likely gaining administrator access to Jenkins.

CVSS v3 6.7 MEDIUM

6.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://www.openwall.com/lists/oss-security/2023/12/13/4	Mailing List
https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3168	Vendor Advisory
http://www.openwall.com/lists/oss-security/2023/12/13/4	Mailing List
https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3168	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:jenkins:openid:*:*:*:*:*:jenkins:*:*

History

21 Nov 2024, 08:37

Type	Values Removed	Values Added
References	~~() http://www.openwall.com/lists/oss-security/2023/12/13/4 - Mailing List~~	() http://www.openwall.com/lists/oss-security/2023/12/13/4 - Mailing List
References	~~() https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3168 - Vendor Advisory~~	() https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3168 - Vendor Advisory

18 Dec 2023, 18:08

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-12-13 18:15

Updated : 2024-11-21 08:37

NVD link : CVE-2023-50770

Mitre link : CVE-2023-50770

CVE.ORG link : CVE-2023-50770

JSON object : View

Products Affected

jenkins

openid

CWE

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2023-50770", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}]}, "published": "2023-12-13T18:15:44.040", "references": [{"url": "http://www.openwall.com/lists/oss-security/2023/12/13/4", "tags": ["Mailing List"], "source": "jenkinsci-cert@googlegroups.com"}, {"url": "https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3168", "tags": ["Vendor Advisory"], "source": "jenkinsci-cert@googlegroups.com"}, {"url": "http://www.openwall.com/lists/oss-security/2023/12/13/4", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3168", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a recoverable format, allowing attackers with access to the Jenkins controller file system to recover the plain text password of that account, likely gaining administrator access to Jenkins."}, {"lang": "es", "value": "El complemento de autenticaci\u00f3n OpenId Connect de Jenkins 2.6 y versiones anteriores almacena una contrase\u00f1a de una cuenta de usuario local utilizada como funci\u00f3n antibloqueo en un formato recuperable, lo que permite a los atacantes con acceso al sistema de archivos del controlador de Jenkins recuperar la contrase\u00f1a de texto plano de esa cuenta, probablemente obteniendo acceso de administrador a Jenkins."}], "lastModified": "2024-11-21T08:37:16.857", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:openid:*:*:*:*:*:jenkins:*:*", "vulnerable": true, "matchCriteriaId": "518C412D-D1E5-4921-8035-DC8709845CA9", "versionEndIncluding": "2.6"}], "operator": "OR"}]}], "sourceIdentifier": "jenkinsci-cert@googlegroups.com"}