PT-2023-22751 · Jenkins · Jenkins Report Portal Plugin+1

Cc Bomber + 1 · Published 2023-04-12 · Updated 2023-04-20 · CVE-2023-30523

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Report Portal Plugin versions 0.5 and earlier

Description The Jenkins Report Portal Plugin stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. The configuration form does not mask these tokens, increasing the potential for attackers to observe and capture them.

Recommendations For Jenkins Report Portal Plugin versions 0.5 and earlier, consider restricting access to the Jenkins controller file system and limiting Item/Extended Read permission to minimize the risk of exploitation. As a temporary workaround, consider masking ReportPortal access tokens in the configuration form until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-311

CWE-312

Related Identifiers

CVE-2023-30523

GHSA-QGW9-VGRF-H723

Affected Products

Jenkins

Jenkins Report Portal Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-30523 · Security Note
• https://jenkins.io/security/advisory/2023-04-12/#SECURITY-2945 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qgw9-vgrf-h723 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-30523 · Vendor Advisory
• http://openwall.com/lists/oss-security/2023/04/13/3 · Note
• https://t.me/cibsecurity/61988 · Telegram Post
• https://t.me/cvenotify/48753 · Telegram Post
• https://t.me/cvenotify/48188 · Telegram Post