CVE-2023-32982 - Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier stores extra variables unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system

Back Back to CVE browser

MEDIUM

Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier stores extra variables unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system

Published May 16, 2023

4.3

MEDIUM

CVSS 3.1

EPSS 0.38%

Description

Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier stores extra variables unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Affected products

Vendor Jenkins Project Product Jenkins Ansible Plugin Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=204.v8191fd551eb_f

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Jenkins Project

Jenkins Ansible Plugin

unaffected

Version	Status	Constraints
0	affected	<=204.v8191fd551eb_f

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-311

Missing Encryption of Sensitive Data

CWE-312

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-1458
Advisory
https://github.com/advisories/GHSA-38hw-368m-7jmg
Advisory
https://github.com/jenkinsci/ansible-plugin/commit/4cbc48657c21a65a917b3b3049918480198c0cfb
https://nvd.nist.gov/vuln/detail/CVE-2023-32982
https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3017
vendor-advisoryVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-1458		Advisory
https://github.com/advisories/GHSA-38hw-368m-7jmg		Advisory
https://github.com/jenkinsci/ansible-plugin/commit/4cbc48657c21a65a917b3b3049918480198c0cfb
https://nvd.nist.gov/vuln/detail/CVE-2023-32982
https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3017		vendor-advisoryVendor Advisory