PT-2023-5741 · Jenkins · Jenkins Nodejs Plugin+1

James Nord · Published 2023-08-16 · Updated 2023-08-22 · CVE-2023-40340

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins NodeJS Plugin versions 1.6.0 and earlier

Description The issue is related to the improper masking of credentials in the Npm config file in Pipeline build logs. This could allow a remote attacker to gain unauthorized access to protected information. The vulnerability is associated with errors in processing credentials in the Pipeline build log.

Recommendations For Jenkins NodeJS Plugin versions 1.6.0 and earlier, update to version 1.6.1 or later, which properly masks credentials specified in the Npm config file in Pipeline build logs.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2023-06413

CVE-2023-40340

GHSA-36FG-WHR2-G999

Affected Products

Jenkins

Jenkins Nodejs Plugin

References · 9

• https://jenkins.io/security/advisory/2023-08-16/#SECURITY-3196 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40340 · Security Note
• https://osv.dev/vulnerability/GHSA-36fg-whr2-g999 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-40340 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06413 · Security Note
• https://github.com/jenkinsci/nodejs-plugin/commit/a2198feb53765f0b1f063b1827e90473a60a25a0 · Note
• https://twitter.com/CVEnew/status/1691822018000277515 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1691852696062468477 · Twitter Post
• http://openwall.com/lists/oss-security/2023/08/16/3 · Note