PT-2023-22744 · Jenkins · Jenkins Thycotic Devops Secrets Vault Plugin+1

Tim Jacomb · Publicado 2023-04-12 · Atualizado 2025-02-07 · CVE-2023-30515

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Thycotic DevOps Secrets Vault Plugin versions 1.0.0 and earlier

Description The issue arises from the improper masking of credentials in the build log when push mode for durable task logging is enabled. This means that credentials are not replaced with asterisks as they should be, potentially exposing sensitive information.

Recommendations For Jenkins Thycotic DevOps Secrets Vault Plugin versions 1.0.0 and earlier, consider disabling the push mode for durable task logging until a proper fix is available to ensure credentials are masked correctly in the build log.

Correção

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

CVE-2023-30515

GHSA-F244-F9FC-W6FQ

Produtos afetados

Jenkins

Jenkins Thycotic Devops Secrets Vault Plugin

Referências · 8

• https://t.me/cvenotify/48829 · Publicação no Telegram
• http://openwall.com/lists/oss-security/2023/04/13/3 · Nota
• https://osv.dev/vulnerability/CVE-2023-30515 · Aviso do Fabricante
• https://t.me/cvenotify/110469 · Publicação no Telegram
• https://jenkins.io/security/advisory/2023-04-12/#SECURITY-3075 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-30515 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-f244-f9fc-w6fq · Aviso do Fabricante
• https://t.me/cibsecurity/61997 · Publicação no Telegram