CVE-2023-32983: Jenkins Ansible Plugin job configuration form does not mask variables

org.jenkins-ci.plugins:ansible Updated 02 Oct 2025

Summary

16/05/2023

Disclosed on

CVE-2023-32983

CVE

Yes i

Fix available

Moderate

Severity

4.3

CVSS Score

CVE-2023-32983: Jenkins Ansible Plugin job configuration form does not mask variables. Affects org.jenkins-ci.plugins:ansible versions < 205.v4cb. Fixed in 205.v4cb. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The Jenkins Ansible Plugin is a tool that allows users to integrate Ansible into their Jenkins workflows. It provides a job configuration form where users can specify extra variables to be passed to Ansible. These extra variables are often used to pass secrets and sensitive information. The plugin stores these extra variables unencrypted in the job config.xml files on the Jenkins controller. This means that users with Item/Extended Read permission or access to the Jenkins controller file system can view these variables. Additionally, the job configuration form does not mask these variables, making it easier for attackers to observe and capture them.

Vulnerability Detail

The vulnerability in the Jenkins Ansible Plugin allows unauthorized users to view and capture sensitive information, such as secrets, stored in the job config.xml files. This can lead to unauthorized access to systems and potential data breaches. The issue arises from the plugin storing extra variables unencrypted and not masking them on the job configuration form. Attackers with access to the Jenkins controller file system or with Item/Extended Read permission can exploit this vulnerability. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.

How To Fix

Minimum fixed version

205.v4cb

This is the first release that contains the fix.

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

There is no specific workaround mentioned for this vulnerability. The recommended solution is to update the Jenkins Ansible Plugin to the latest version.

Conclusion

The Jenkins Ansible Plugin is vulnerable to unauthorized access and data breaches due to the storage of unencrypted extra variables in job config.xml files and the lack of masking on the job configuration form. Users should update to Ansible Plugin version 205.v4cb or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for org.jenkins-ci.plugins:ansible →