PT-2023-22743 · Jenkins · Jenkins Azure Key Vault Plugin+1

Tim Jacomb · Publicado 2023-04-12 · Atualizado 2025-02-07 · CVE-2023-30514

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Azure Key Vault Plugin versions 187.va cd5fecd198a and earlier

Description The issue arises when the push mode for durable task logging is enabled, causing the plugin to not properly mask credentials in the build log. This means that instead of being replaced with asterisks, credentials are visible, potentially exposing sensitive information.

Recommendations For Jenkins Azure Key Vault Plugin versions 187.va cd5fecd198a and earlier, consider disabling the push mode for durable task logging until a fix is available to prevent credentials from being exposed in the build log.

Correção

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

CVE-2023-30514

GHSA-GMXM-PR58-V5JC

Produtos afetados

Jenkins

Jenkins Azure Key Vault Plugin

Referências · 8

• http://openwall.com/lists/oss-security/2023/04/13/3 · Nota
• https://t.me/cibsecurity/61985 · Publicação no Telegram
• https://jenkins.io/security/advisory/2023-04-12/#SECURITY-3075 · Aviso do Fabricante
• https://t.me/cvenotify/110468 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-gmxm-pr58-v5jc · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-30514 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-30514 · Aviso do Fabricante
• https://t.me/cvenotify/48832 · Publicação no Telegram