GitHub Advisoryadvisory · Maven

GHSA-54cw-rvr3-w6cx Jenkins Consul KV Builder Plugin stores HashiCorp Consul ACL Token unencrypted

MEDIUM Published 2023-04-12 Modified 2023-04-12 Official page ↗
Aliases
CVE-2023-30531
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:consul-kv-builder
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-312
Reviewed
2023-04-12

Affected packages

• Maven org.jenkins-ci.plugins:consul-kv-builder: <= 2.0.13 (no fix yet)

Description

Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file `org.jenkinsci.plugins.consulkv.GlobalConsulConfig.xml` on the Jenkins controller as part of its configuration. This token can be viewed by users with access to the Jenkins controller file system. Additionally, the global configuration form does not mask the token, increasing the potential for attackers to observe and capture it.

Related

Alias · CVE (1)

  • CVE-2023-30531 Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not mask the HashiCorp Consul ACL Token on the global configuration form,… vulnerability

Weakness · CWE (1)

  • CWE-312 Cleartext Storage of Sensitive Information weakness

References