Description

Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2023/04/13/3

https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2944

Related Vulnerabilities

CVE-2021-32621 Vulnerability in maven package org.xwiki.platform:xwiki-platform-dashboard-macro

CVE-2020-1957 Vulnerability in maven package org.apache.shiro:shiro-web

CVE-2023-48796 Vulnerability in maven package org.apache.dolphinscheduler:dolphinscheduler-alert-server

CVE-2020-11971 Vulnerability in maven package org.apache.camel:camel-api

CVE-2023-30526 Vulnerability in maven package org.jenkins-ci.plugins:reportportal

Severity

Medium

Classification

CWE-312 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Mailing List Third Party Advisory Vendor Advisory