PT-2023-22744 · Jenkins · Jenkins Thycotic Devops Secrets Vault Plugin+1

Tim Jacomb · Published 2023-04-12 · Updated 2025-02-07 · CVE-2023-30515

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Thycotic DevOps Secrets Vault Plugin versions 1.0.0 and earlier

Description The issue arises from the improper masking of credentials in the build log when push mode for durable task logging is enabled. This means that credentials are not replaced with asterisks as they should be, potentially exposing sensitive information.

Recommendations For Jenkins Thycotic DevOps Secrets Vault Plugin versions 1.0.0 and earlier, consider disabling the push mode for durable task logging until a proper fix is available to ensure credentials are masked correctly in the build log.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2023-30515

GHSA-F244-F9FC-W6FQ

Affected Products

Jenkins

Jenkins Thycotic Devops Secrets Vault Plugin

References · 8

• https://osv.dev/vulnerability/CVE-2023-30515 · Vendor Advisory
• https://jenkins.io/security/advisory/2023-04-12/#SECURITY-3075 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30515 · Security Note
• https://osv.dev/vulnerability/GHSA-f244-f9fc-w6fq · Vendor Advisory
• https://t.me/cvenotify/48829 · Telegram Post
• http://openwall.com/lists/oss-security/2023/04/13/3 · Note
• https://t.me/cvenotify/110469 · Telegram Post
• https://t.me/cibsecurity/61997 · Telegram Post