PT-2023-24115 · Jenkins · Jenkins Ansible Plugin+1

Kevin Guerroudj · Published 2023-05-16 · Updated 2023-05-25 · CVE-2023-32982

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Ansible Plugin versions 204.v8191fd551eb f and earlier

Description The issue concerns the storage of extra variables, often used to pass secrets, in an unencrypted manner in job config.xml files on the Jenkins controller. These variables can be accessed by users with Item/Extended Read permission or those with access to the Jenkins controller file system. Furthermore, the job configuration form does not mask these extra variables, potentially allowing attackers to observe and capture them.

Recommendations For Jenkins Ansible Plugin versions 204.v8191fd551eb f and earlier, update to version 205.v4cb c48657c21 or later to ensure extra variables are stored encrypted and masked on the configuration form.

Fix

Cleartext Storage of Sensitive Information

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-312

CWE-311

Related Identifiers

CVE-2023-32982

GHSA-38HW-368M-7JMG

Affected Products

Jenkins

Jenkins Ansible Plugin

References · 5

• https://osv.dev/vulnerability/GHSA-38hw-368m-7jmg · Vendor Advisory
• https://jenkins.io/security/advisory/2023-05-16/#SECURITY-3017 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32982 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32982 · Vendor Advisory
• https://github.com/jenkinsci/ansible-plugin/commit/4cbc48657c21a65a917b3b3049918480198c0cfb · Note