PT-2023-28844 · Jenkins · Jenkins

Sunita · Published 2023-09-20 · Updated 2024-03-06 · CVE-2023-43494

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.50 through 2.423 Jenkins LTS versions 2.60.1 through 2.414.1

Description The issue allows attackers with Item/Read permission to obtain values of sensitive variables used in builds by iteratively testing different characters until the correct sequence is discovered. This is because sensitive build variables, such as password parameter values, are not excluded from the search in the build history widget.

Recommendations For Jenkins versions 2.50 through 2.423, update to version 2.424 or later. For Jenkins LTS versions 2.60.1 through 2.414.1, update to version 2.414.2 or later. As a temporary workaround, consider restricting access to the build history widget for users with Item/Read permission until a patch is applied.

Fix

Related Identifiers

BIT-JENKINS-2023-43494

CVE-2023-43494

GHSA-279F-QWGH-H5MP

Affected Products

Jenkins

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2023-43494 · Security Note
• https://jenkins.io/security/advisory/2023-09-20/#SECURITY-3261 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-43494 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jenkins-2023-43494 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-279f-qwgh-h5mp · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/b8ac8cd4c51511b9f844846ba80a8aed054288c5 · Note
• http://openwall.com/lists/oss-security/2023/09/20/5 · Note
• https://twitter.com/fletch_ai/status/1706958623815918029 · Twitter Post
• https://t.me/cvenotify/58198 · Telegram Post
• https://t.me/cvenotify/58191 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1704571692201202039 · Twitter Post
• https://t.me/cibsecurity/70809 · Telegram Post
• https://twitter.com/CVEnew/status/1704530935453188356 · Twitter Post