SB2023041346 - Multiple vulnerabilities in Jenkins Consul KV Builder plugin

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Cleartext storage of sensitive information (CVE-ID: CVE-2023-30530)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the affected plugin stores the HashiCorp Consul ACL Token unencrypted in its global configuration file org.jenkinsci.plugins.consulkv.GlobalConsulConfig.xml on the Jenkins controller as part of its configuration. A remote user can gain access to this token.

2) Information disclosure (CVE-ID: CVE-2023-30531)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the global configuration form does not mask the token. A remote user can observe and capture it.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2944
• https://jenkins.io/security/advisory/2023-04-12/