PT-2023-20611 · Jenkins · Credentials Plugin+2

Kevin Guerroudj · Publicado 2023-05-16 · Atualizado 2023-05-25 · CVE-2023-2632

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Code Dx Plugin versions 3.1.0 and earlier

Description The issue concerns the storage of Code Dx server API keys in an unencrypted manner in job config.xml files on the Jenkins controller. These keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Furthermore, the job configuration form does not mask these API keys, increasing the potential for them to be observed and captured by attackers.

Recommendations For Jenkins Code Dx Plugin versions 3.1.0 and earlier, reconfigure affected jobs to use the Credentials Plugin integration, as provided in version 4.0.0, which no longer stores API keys directly. As a temporary workaround, consider restricting access to the Jenkins controller file system and limiting Item/Extended Read permission to minimize the risk of API key exposure.

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

CWE-256

Identificadores relacionados

CVE-2023-2632

GHSA-GPC2-F62M-C6H6

Produtos afetados

Credentials Plugin

Jenkins

Jenkins Code Dx Plugin

Referências · 6

• https://github.com/jenkinsci/codedx-plugin/commit/a971a75da3eaf0ab5344c2b60942e7c8809ec913 · Nota
• https://osv.dev/vulnerability/CVE-2023-2632 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-2632 · Nota de Segurança
• https://jenkins.io/security/advisory/2023-05-16/#SECURITY-3146 · Aviso do Fabricante
• https://t.me/cibsecurity/64260 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-gpc2-f62m-c6h6 · Aviso do Fabricante