PT-2023-28172 · Jenkins · Jenkins Pipeline Maven Integration Plugin+1

Yaroslav Afenkin · Published 2023-09-06 · Updated 2024-09-26 · CVE-2023-41934

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Pipeline Maven Integration Plugin versions 1330.v18e473854496 and earlier

Description The issue concerns the Jenkins Pipeline Maven Integration Plugin, which does not properly mask usernames of credentials specified in custom Maven settings in Pipeline build logs when "Treat username as secret" is checked. This affects the security of credentials by potentially exposing them in the build logs.

Recommendations For Jenkins Pipeline Maven Integration Plugin versions 1330.v18e473854496 and earlier, consider disabling the "Treat username as secret" option until a patch is available, or restrict access to the Pipeline build logs to minimize the risk of credential exposure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2023-41934

GHSA-9V8G-F9MQ-739G

Affected Products

Jenkins

Jenkins Pipeline Maven Integration Plugin

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-41934 · Security Note
• https://osv.dev/vulnerability/GHSA-9v8g-f9mq-739g · Vendor Advisory
• https://jenkins.io/security/advisory/2023-09-06/#SECURITY-3257 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-41934 · Vendor Advisory
• https://t.me/cvenotify/96232 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1699435469581218103 · Twitter Post
• http://openwall.com/lists/oss-security/2023/09/06/9 · Note
• https://t.me/cibsecurity/70003 · Telegram Post
• https://twitter.com/CVEnew/status/1699416760188109185 · Twitter Post