All the vulnerabilites related to Jenkins Project - Jenkins Consul KV Builder Plugin
cve-2023-30530
Vulnerability from cvelistv5
Published
2023-04-12 17:05
Modified
2024-08-02 14:28
Severity ?
EPSS score ?
Summary
Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
References
Impacted products
▼ | Vendor | Product |
---|---|---|
Jenkins Project | Jenkins Consul KV Builder Plugin |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T14:28:51.795Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "Jenkins Security Advisory 2023-04-12", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2944" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/04/13/3" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unknown", "product": "Jenkins Consul KV Builder Plugin", "vendor": "Jenkins Project", "versions": [ { "lessThanOrEqual": "2.0.13", "status": "affected", "version": "0", "versionType": "maven" } ] } ], "descriptions": [ { "lang": "en", "value": "Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system." } ], "providerMetadata": { "dateUpdated": "2023-10-24T12:49:52.993Z", "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins" }, "references": [ { "name": "Jenkins Security Advisory 2023-04-12", "tags": [ "vendor-advisory" ], "url": "https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2944" }, { "url": "http://www.openwall.com/lists/oss-security/2023/04/13/3" } ] } }, "cveMetadata": { "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "assignerShortName": "jenkins", "cveId": "CVE-2023-30530", "datePublished": "2023-04-12T17:05:17.918Z", "dateReserved": "2023-04-12T08:40:40.605Z", "dateUpdated": "2024-08-02T14:28:51.795Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-30531
Vulnerability from cvelistv5
Published
2023-04-12 17:05
Modified
2024-08-02 14:28
Severity ?
EPSS score ?
Summary
Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not mask the HashiCorp Consul ACL Token on the global configuration form, increasing the potential for attackers to observe and capture it.
References
Impacted products
▼ | Vendor | Product |
---|---|---|
Jenkins Project | Jenkins Consul KV Builder Plugin |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T14:28:51.969Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "Jenkins Security Advisory 2023-04-12", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2944" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/04/13/3" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unknown", "product": "Jenkins Consul KV Builder Plugin", "vendor": "Jenkins Project", "versions": [ { "lessThanOrEqual": "2.0.13", "status": "affected", "version": "0", "versionType": "maven" } ] } ], "descriptions": [ { "lang": "en", "value": "Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not mask the HashiCorp Consul ACL Token on the global configuration form, increasing the potential for attackers to observe and capture it." } ], "providerMetadata": { "dateUpdated": "2023-10-24T12:49:54.188Z", "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins" }, "references": [ { "name": "Jenkins Security Advisory 2023-04-12", "tags": [ "vendor-advisory" ], "url": "https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2944" }, { "url": "http://www.openwall.com/lists/oss-security/2023/04/13/3" } ] } }, "cveMetadata": { "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "assignerShortName": "jenkins", "cveId": "CVE-2023-30531", "datePublished": "2023-04-12T17:05:18.653Z", "dateReserved": "2023-04-12T08:40:40.605Z", "dateUpdated": "2024-08-02T14:28:51.969Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }