PT-2023-22743 · Jenkins · Jenkins Azure Key Vault Plugin+1

Tim Jacomb · Published 2023-04-12 · Updated 2025-02-07 · CVE-2023-30514

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Azure Key Vault Plugin versions 187.va cd5fecd198a and earlier

Description The issue arises when the push mode for durable task logging is enabled, causing the plugin to not properly mask credentials in the build log. This means that instead of being replaced with asterisks, credentials are visible, potentially exposing sensitive information.

Recommendations For Jenkins Azure Key Vault Plugin versions 187.va cd5fecd198a and earlier, consider disabling the push mode for durable task logging until a fix is available to prevent credentials from being exposed in the build log.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2023-30514

GHSA-GMXM-PR58-V5JC

Affected Products

Jenkins

Jenkins Azure Key Vault Plugin

References · 8

• https://jenkins.io/security/advisory/2023-04-12/#SECURITY-3075 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gmxm-pr58-v5jc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30514 · Security Note
• https://osv.dev/vulnerability/CVE-2023-30514 · Vendor Advisory
• http://openwall.com/lists/oss-security/2023/04/13/3 · Note
• https://t.me/cibsecurity/61985 · Telegram Post
• https://t.me/cvenotify/110468 · Telegram Post
• https://t.me/cvenotify/48832 · Telegram Post