CVE-2023-24450

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

J

enkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

References

Link	Resource
https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2787	Vendor Advisory
https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2787	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:jenkins:view-cloner:1.0:::::jenkins::
	cpe:2.3:a:jenkins:view-cloner:1.1:::::jenkins::

History

21 Nov 2024, 07:47

Type	Values Removed	Values Added
Summary		(es) El complemento view-cloner de Jenkins en su versión 1.1 y anteriores almacena contraseñas sin cifrar en archivos job config.xml en el controlador Jenkins, donde los usuarios con permiso de lectura extendida pueden verlas o acceder al sistema de archivos del controlador Jenkins.
References	~~() https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2787 - Vendor Advisory~~	() https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2787 - Vendor Advisory

Information

Published : 2023-01-26 21:18

Updated : 2025-04-02 14:15

NVD link : CVE-2023-24450

Mitre link : CVE-2023-24450

CVE.ORG link : CVE-2023-24450

JSON object : View

Products Affected

view-cloner

CWE

CWE-312

Cleartext Storage of Sensitive Information

{"id": "CVE-2023-24450", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2023-01-26T21:18:18.487", "references": [{"url": "https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2787", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2787", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-312"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-312"}]}], "descriptions": [{"lang": "en", "value": "Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system."}, {"lang": "es", "value": "El complemento view-cloner de Jenkins en su versi\u00f3n 1.1 y anteriores almacena contrase\u00f1as sin cifrar en archivos job config.xml en el controlador Jenkins, donde los usuarios con permiso de lectura extendida pueden verlas o acceder al sistema de archivos del controlador Jenkins."}], "lastModified": "2025-04-02T14:15:41.323", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:view-cloner:1.0:*:*:*:*:jenkins:*:*", "vulnerable": true, "matchCriteriaId": "672D351E-9D89-4891-9154-06449A73F135"}, {"criteria": "cpe:2.3:a:jenkins:view-cloner:1.1:*:*:*:*:jenkins:*:*", "vulnerable": true, "matchCriteriaId": "964664A9-C3A1-45B1-93A1-8A07C43BD484"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}