Description
Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter values) from the search in the build history widget, allowing attackers with Item/Read permission to obtain values of sensitive variables used in builds by iteratively testing different characters until the correct sequence is discovered.
Remediation
References
http://www.openwall.com/lists/oss-security/2023/09/20/5
https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3261
Related Vulnerabilities
CVE-2019-16148 Vulnerability in maven package org.sakaiproject:chat-base
CVE-2021-32641 Vulnerability in npm package auth0-lock
CVE-2023-23936 Vulnerability in maven package org.webjars.npm:undici
CVE-2022-36077 Vulnerability in maven package org.webjars.npm:electron
CVE-2019-1003042 Vulnerability in maven package org.6wind.jenkins:lockable-resources