PT-2023-22751 · Jenkins · Jenkins Report Portal Plugin+1

Cc Bomber + 1 · Publicado 2023-04-12 · Atualizado 2023-04-20 · CVE-2023-30523

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Report Portal Plugin versions 0.5 and earlier

Description The Jenkins Report Portal Plugin stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. The configuration form does not mask these tokens, increasing the potential for attackers to observe and capture them.

Recommendations For Jenkins Report Portal Plugin versions 0.5 and earlier, consider restricting access to the Jenkins controller file system and limiting Item/Extended Read permission to minimize the risk of exploitation. As a temporary workaround, consider masking ReportPortal access tokens in the configuration form until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-311

CWE-312

Identificadores relacionados

CVE-2023-30523

GHSA-QGW9-VGRF-H723

Produtos afetados

Jenkins

Jenkins Report Portal Plugin

Referências · 8

• http://openwall.com/lists/oss-security/2023/04/13/3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-30523 · Nota de Segurança
• https://jenkins.io/security/advisory/2023-04-12/#SECURITY-2945 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-qgw9-vgrf-h723 · Aviso do Fabricante
• https://t.me/cibsecurity/61988 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-30523 · Aviso do Fabricante
• https://t.me/cvenotify/48753 · Publicação no Telegram
• https://t.me/cvenotify/48188 · Publicação no Telegram