PT-2023-31639 · Jenkins · Jenkins Openid Connect Authentication Plugin+1

Steve Marlowe · Published 2023-12-13 · Updated 2023-12-18 · CVE-2023-50770

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins OpenId Connect Authentication Plugin versions 2.6 and earlier

Description The issue allows attackers with access to the Jenkins controller file system to recover the plain text password of a local user account used as an anti-lockout feature, likely gaining administrator access to Jenkins. This is due to the password being stored in a recoverable format.

Recommendations For versions 2.6 and earlier, update to a version later than 2.6 to resolve the issue. As a temporary workaround, consider restricting access to the Jenkins controller file system to minimize the risk of exploitation.

Fix

Insufficiently Protected Credentials

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-522

CWE-312

Related Identifiers

CVE-2023-50770

GHSA-6R5W-JJR5-QVGR

Affected Products

Jenkins

Jenkins Openid Connect Authentication Plugin

References · 11

• https://osv.dev/vulnerability/GHSA-6r5w-jjr5-qvgr · Vendor Advisory
• https://jenkins.io/security/advisory/2023-12-13/#SECURITY-3168 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50770 · Security Note
• https://osv.dev/vulnerability/CVE-2023-50770 · Vendor Advisory
• https://github.com/jenkins-infra/update-center2/pull/773 · Note
• https://github.com/jenkinsci/oic-auth-plugin · Note
• https://github.com/jenkinsci/oic-auth-plugin/issues/259 · Note
• https://github.com/jenkinsci/oic-auth-plugin/pull/287 · Note
• http://openwall.com/lists/oss-security/2023/12/13/4 · Note
• https://twitter.com/CVEnew/status/1734991772416184396 · Twitter Post
• https://t.me/cvenotify/63955 · Telegram Post