PT-2023-28844 · Jenkins · Jenkins

Sunita · Publicado 2023-09-20 · Atualizado 2024-03-06 · CVE-2023-43494

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.50 through 2.423 Jenkins LTS versions 2.60.1 through 2.414.1

Description The issue allows attackers with Item/Read permission to obtain values of sensitive variables used in builds by iteratively testing different characters until the correct sequence is discovered. This is because sensitive build variables, such as password parameter values, are not excluded from the search in the build history widget.

Recommendations For Jenkins versions 2.50 through 2.423, update to version 2.424 or later. For Jenkins LTS versions 2.60.1 through 2.414.1, update to version 2.414.2 or later. As a temporary workaround, consider restricting access to the build history widget for users with Item/Read permission until a patch is applied.

Correção

Identificadores relacionados

BIT-JENKINS-2023-43494

CVE-2023-43494

GHSA-279F-QWGH-H5MP

Produtos afetados

Jenkins

Referências · 14

• https://github.com/jenkinsci/jenkins · Nota
• https://github.com/jenkinsci/jenkins/commit/b8ac8cd4c51511b9f844846ba80a8aed054288c5 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-43494 · Nota de Segurança
• https://jenkins.io/security/advisory/2023-09-20/#SECURITY-3261 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2023/09/20/5 · Nota
• https://twitter.com/fletch_ai/status/1706958623815918029 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-43494 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-jenkins-2023-43494 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-279f-qwgh-h5mp · Aviso do Fabricante
• https://t.me/cvenotify/58198 · Publicação no Telegram
• https://t.me/cvenotify/58191 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1704571692201202039 · Publicação no Twitter
• https://t.me/cibsecurity/70809 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1704530935453188356 · Publicação no Twitter