PT-2023-22759 · Hashicorp+1 · Hashicorp Consul+2

Cc Bomber + 1 · Published 2023-04-12 · Updated 2025-02-07 · CVE-2023-30530

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Consul KV Builder Plugin versions 2.0.13 and earlier

Description The issue concerns the storage of the HashiCorp Consul ACL Token in the global configuration file on the Jenkins controller. This token is stored unencrypted and can be viewed by users with access to the Jenkins controller file system. The global configuration form does not mask the token, increasing the potential for attackers to observe and capture it. The file in question is org.jenkinsci.plugins.consulkv.GlobalConsulConfig.xml.

Recommendations For Jenkins Consul KV Builder Plugin versions 2.0.13 and earlier, consider restricting access to the Jenkins controller file system to minimize the risk of the HashiCorp Consul ACL Token being viewed by unauthorized users. As a temporary workaround, limit access to the global configuration form to prevent the token from being observed and captured. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2023-30530

GHSA-96C7-FQXV-RMV7

Affected Products

Hashicorp Consul

Jenkins

Jenkins Consul Kv Builder Plugin

References · 9

• https://osv.dev/vulnerability/GHSA-96c7-fqxv-rmv7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30530 · Security Note
• https://jenkins.io/security/advisory/2023-04-12/#SECURITY-2944 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-30530 · Vendor Advisory
• http://openwall.com/lists/oss-security/2023/04/13/3 · Note
• https://t.me/cvenotify/110441 · Telegram Post
• https://t.me/cvenotify/48181 · Telegram Post
• https://t.me/cibsecurity/61984 · Telegram Post
• https://t.me/cvenotify/48773 · Telegram Post