PT-2023-5741 · Jenkins · Jenkins Nodejs Plugin+1

James Nord · Publicado 2023-08-16 · Atualizado 2023-08-22 · CVE-2023-40340

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins NodeJS Plugin versions 1.6.0 and earlier

Description The issue is related to the improper masking of credentials in the Npm config file in Pipeline build logs. This could allow a remote attacker to gain unauthorized access to protected information. The vulnerability is associated with errors in processing credentials in the Pipeline build log.

Recommendations For Jenkins NodeJS Plugin versions 1.6.0 and earlier, update to version 1.6.1 or later, which properly masks credentials specified in the Npm config file in Pipeline build logs.

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

BDU:2023-06413

CVE-2023-40340

GHSA-36FG-WHR2-G999

Produtos afetados

Jenkins

Jenkins Nodejs Plugin

Referências · 9

• https://github.com/jenkinsci/nodejs-plugin/commit/a2198feb53765f0b1f063b1827e90473a60a25a0 · Nota
• https://jenkins.io/security/advisory/2023-08-16/#SECURITY-3196 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-40340 · Nota de Segurança
• https://twitter.com/CVEnew/status/1691822018000277515 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1691852696062468477 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-36fg-whr2-g999 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-40340 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2023/08/16/3 · Nota
• https://bdu.fstec.ru/vul/2023-06413 · Nota de Segurança