GSD-2023-30530
Vulnerability from gsd - Updated: 2023-12-13 01:20Details
Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2023-30530",
"id": "GSD-2023-30530"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2023-30530"
],
"details": "Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.",
"id": "GSD-2023-30530",
"modified": "2023-12-13T01:20:52.157047Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "jenkinsci-cert@googlegroups.com",
"ID": "CVE-2023-30530",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Jenkins Consul KV Builder Plugin",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "0",
"version_value": "2.0.13"
}
]
}
}
]
},
"vendor_name": "Jenkins Project"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2944",
"refsource": "MISC",
"url": "https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2944"
},
{
"name": "http://www.openwall.com/lists/oss-security/2023/04/13/3",
"refsource": "MISC",
"url": "http://www.openwall.com/lists/oss-security/2023/04/13/3"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "(,2.0.13]",
"affected_versions": "All versions up to 2.0.13",
"cwe_ids": [
"CWE-1035",
"CWE-937"
],
"date": "2023-04-12",
"description": "Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.",
"fixed_versions": [],
"identifier": "CVE-2023-30530",
"identifiers": [
"GHSA-96c7-fqxv-rmv7",
"CVE-2023-30530"
],
"not_impacted": "",
"package_slug": "maven/org.jenkins-ci.plugins/consul-kv-builder",
"pubdate": "2023-04-12",
"solution": "Unfortunately, there is no solution available yet.",
"title": "Jenkins Consul KV Builder Plugin stores HashiCorp Consul ACL Token unencrypted",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2023-30530",
"https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2944",
"https://github.com/advisories/GHSA-96c7-fqxv-rmv7"
],
"uuid": "9623f96a-5322-476e-abda-a683f25d8586"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:jenkins:consul_kv_builder:*:*:*:*:*:jenkins:*:*",
"cpe_name": [],
"versionEndIncluding": "2.0.13",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "jenkinsci-cert@googlegroups.com",
"ID": "CVE-2023-30530"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-312"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2944",
"refsource": "MISC",
"tags": [
"Vendor Advisory"
],
"url": "https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2944"
},
{
"name": "http://www.openwall.com/lists/oss-security/2023/04/13/3",
"refsource": "MISC",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2023/04/13/3"
}
]
}
},
"impact": {
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
},
"lastModifiedDate": "2023-04-20T22:04Z",
"publishedDate": "2023-04-12T18:15Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…