PT-2023-24132 · Jenkins · Jenkins Ns-Nd Integration Performance Publisher Plugin+1

Kevin Guerroudj · Publicado 2023-05-16 · Atualizado 2023-05-31 · CVE-2023-33000

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins NS-ND Integration Performance Publisher Plugin versions 4.8.0.149 and earlier

Description The issue concerns the Jenkins NS-ND Integration Performance Publisher Plugin, where credentials are not masked on the configuration form, allowing potential attackers to observe and capture them. Although the credentials are stored encrypted on disk, the lack of masking on the job configuration form increases the risk.

Recommendations For versions 4.8.0.149 and earlier, update to version 4.11.0.48 or later, which masks credentials displayed on the configuration form. As a temporary workaround, consider restricting access to the configuration form to minimize the risk of exploitation.

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2023-33000

GHSA-GQXR-HVRW-6HFH

Produtos afetados

Jenkins

Jenkins Ns-Nd Integration Performance Publisher Plugin

Referências · 6

• https://t.me/cvenotify/50571 · Publicação no Telegram
• https://jenkins.io/security/advisory/2023-05-16/#SECURITY-2962 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-33000 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-33000 · Aviso do Fabricante
• https://t.me/cibsecurity/64225 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-gqxr-hvrw-6hfh · Aviso do Fabricante