CVE-2023-43494
MEDIUM 4.3EPSS 3.9%
Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter values) from the search in the build history widget, allowing attackers with Item/Read permission to obtain values of sensitive variables used in builds by iteratively testing different characters until the correct sequence is discovered.
- Affected
- Jenkins Project · Jenkins
- CVSS v3.1 NVD
- 4.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - EPSS
- 3.94% chance of exploitation in the next 30 days, 90th percentile
- Published
- 2023-09-20
- Updated
- 2024-09-24
Proof-of-concept exploits (2)
- mqxmm/CVE-2023-434940★ · 2024-08-21
- sagarwal395/ExploitRepo0★ · 2024-08-15
Security advisories
- https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3261
- http://www.openwall.com/lists/oss-security/2023/09/20/5
- advisories/GHSA-279f-qwgh-h5mp