Description

Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not mask the HashiCorp Consul ACL Token on the global configuration form, increasing the potential for attackers to observe and capture it.

Remediation

References

https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2944

http://www.openwall.com/lists/oss-security/2023/04/13/3

Related Vulnerabilities

CVE-2022-31142 Vulnerability in npm package @fastify/bearer-auth

CVE-2023-36479 Vulnerability in maven package org.eclipse.jetty:jetty-servlets

CVE-2009-1190 Vulnerability in maven package org.springframework:spring-core

CVE-2012-1089 Vulnerability in maven package org.apache.wicket:wicket-core

CVE-2022-31093 Vulnerability in npm package next-auth

Severity

High

Classification

CWE-312 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Vendor Advisory Mailing List Third Party Advisory