OpenCVE

Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files when they're written to the build log.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Jenkins	Config File Provider
Jenkins Project	Jenkins Config File Provider Plugin
Redhat	Ocp Tools

Configuration 1 [-]

cpe:2.3:a:jenkins:config_file_provider:*:*:*:*:*:jenkins:*:*

Package	CPE	Advisory	Released Date
OCP-Tools-4.12-RHEL-8
jenkins-2-plugins-0:4.12.1706515741-1.el8	cpe:/a:redhat:ocp_tools:4.12::el8	RHSA-2024:0778	2024-02-12T00:00:00Z
OCP-Tools-4.14-RHEL-8
jenkins-2-plugins-0:4.14.1706516441-1.el8	cpe:/a:redhat:ocp_tools:4.14::el8	RHSA-2024:0777	2024-02-12T00:00:00Z

References

Link	Providers
http://www.openwall.com/lists/oss-security/2023/08/16/3
https://nvd.nist.gov/vuln/detail/CVE-2023-40339
https://www.cve.org/CVERecord?id=CVE-2023-40339
https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3090

History

Tue, 08 Oct 2024 18:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Jenkins Project Jenkins Project jenkins Config File Provider Plugin
CPEs		cpe:2.3:a:jenkins_project:jenkins_config_file_provider_plugin::::::::
Vendors & Products		Jenkins Project Jenkins Project jenkins Config File Provider Plugin
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: jenkins

Published: 2023-08-16T14:32:51.314Z

Updated: 2024-10-08T17:49:36.202Z

Reserved: 2023-08-14T16:02:56.435Z

Link: CVE-2023-40339

Vulnrichment

Updated: 2024-08-02T18:31:53.808Z

NVD

Status : Modified

Published: 2023-08-16T15:15:11.547

Modified: 2024-11-21T08:19:15.080

Link: CVE-2023-40339

Redhat

Severity : Moderate

Publid Date: 2023-08-16T00:00:00Z

Links: CVE-2023-40339 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-40339", "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "state": "PUBLISHED", "assignerShortName": "jenkins", "dateReserved": "2023-08-14T16:02:56.435Z", "datePublished": "2023-08-16T14:32:51.314Z", "dateUpdated": "2024-10-08T17:49:36.202Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "Jenkins Config File Provider Plugin", "vendor": "Jenkins Project", "versions": [{"lessThan": "*", "status": "unaffected", "version": "953.v0432a_802e4d2", "versionType": "maven"}, {"status": "unaffected", "version": "951.953.vdfc5f6e2dcc4"}]}], "descriptions": [{"lang": "en", "value": "Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files when they're written to the build log."}], "providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2023-10-24T12:51:22.838Z"}, "references": [{"name": "Jenkins Security Advisory 2023-08-16", "tags": ["vendor-advisory"], "url": "https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3090"}, {"url": "http://www.openwall.com/lists/oss-security/2023/08/16/3"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:31:53.808Z"}, "title": "CVE Program Container", "references": [{"name": "Jenkins Security Advisory 2023-08-16", "tags": ["vendor-advisory", "x_transferred"], "url": "https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3090"}, {"url": "http://www.openwall.com/lists/oss-security/2023/08/16/3", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "jenkins_project", "product": "jenkins_config_file_provider_plugin", "cpes": ["cpe:2.3:a:jenkins_project:jenkins_config_file_provider_plugin:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "953.v0432a_802e4d2", "status": "unaffected", "lessThan": "*", "versionType": "custom"}, {"version": "951.953.vdfc5f6e2dcc4", "status": "unaffected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-08T17:42:10.495502Z", "id": "CVE-2023-40339", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-08T17:49:36.202Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3090", "name": "Jenkins Security Advisory 2023-08-16", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2023/08/16/3", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:31:53.808Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-40339", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-08T17:42:10.495502Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:jenkins_project:jenkins_config_file_provider_plugin:*:*:*:*:*:*:*:*"], "vendor": "jenkins_project", "product": "jenkins_config_file_provider_plugin", "versions": [{"status": "unaffected", "version": "953.v0432a_802e4d2", "lessThan": "*", "versionType": "custom"}, {"status": "unaffected", "version": "951.953.vdfc5f6e2dcc4"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-08T17:47:56.712Z"}}], "cna": {"affected": [{"vendor": "Jenkins Project", "product": "Jenkins Config File Provider Plugin", "versions": [{"status": "unaffected", "version": "953.v0432a_802e4d2", "lessThan": "*", "versionType": "maven"}, {"status": "unaffected", "version": "951.953.vdfc5f6e2dcc4"}], "defaultStatus": "affected"}], "references": [{"url": "https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3090", "name": "Jenkins Security Advisory 2023-08-16", "tags": ["vendor-advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2023/08/16/3"}], "descriptions": [{"lang": "en", "value": "Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files when they're written to the build log."}], "providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2023-10-24T12:51:22.838Z"}}}, "cveMetadata": {"cveId": "CVE-2023-40339", "state": "PUBLISHED", "dateUpdated": "2024-10-08T17:49:36.202Z", "dateReserved": "2023-08-14T16:02:56.435Z", "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "datePublished": "2023-08-16T14:32:51.314Z", "assignerShortName": "jenkins"}, "dataVersion": "5.1"}