Description
Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not mask the HashiCorp Consul ACL Token on the global configuration form, increasing the potential for attackers to observe and capture it.
Remediation
References
http://www.openwall.com/lists/oss-security/2023/04/13/3
https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2944
Related Vulnerabilities
CVE-2020-2280 Vulnerability in maven package io.jenkins.plugins:warnings-ng
CVE-2019-0195 Vulnerability in maven package org.apache.tapestry:tapestry-core
CVE-2021-43570 Vulnerability in maven package com.starkbank.ellipticcurve:starkbank-ecdsa
CVE-2022-1466 Vulnerability in maven package org.keycloak:keycloak-core
CVE-2020-35774 Vulnerability in maven package com.twitter:twitter-server