CVE-2023-40339: Jenkins Config File Provider Plugin improper credential masking vulnerability
Summary
CVE-2023-40339: Jenkins Config File Provider Plugin improper credential masking vulnerability. Affects org.jenkins-ci.plugins:config-file-provider versions < 953.v0432a. Fixed in 953.v0432a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Config File Provider Plugin is a Maven package (org.jenkins-ci.plugins:config-file-provider) that allows users to define and manage configuration files for their Jenkins builds. These configuration files can contain sensitive information such as credentials. The plugin is widely used in Jenkins environments to simplify the management of configuration files across different projects.
Vulnerability Detail
The Jenkins Config File Provider Plugin version 952.va_544a_6234b_46 and earlier does not properly mask credentials specified in configuration files when they are written to the build log. This means that if an attacker gains access to the build log, they can extract sensitive credentials in plain text. However, the Config File Provider Plugin version 953.v0432a_802e4d2 addresses this issue by masking credentials configured in configuration files if they appear in the build log.
How To Fix
Minimum fixed version
953.v0432a
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
Conclusion
The Jenkins Config File Provider Plugin is vulnerable to improper credential masking, which can lead to unauthorized access to sensitive information. Users should upgrade to the latest version of the plugin to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:config-file-provider →
FAQ
This vulnerability allows an attacker with access to the build log to extract sensitive credentials in plain text, potentially leading to unauthorized access to systems or data.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins environment is affected by this vulnerability. Simply enter your pom.xml file and Vulert will analyze it in real-time and provide alerts for any open-source vulnerabilities, including this one.
Yes, the CVSS score for this vulnerability is 4.3, indicating a moderate severity level.
There are no known exploits for this vulnerability at the time of this report. However, it is important to promptly upgrade to the fixed version to mitigate the risk.
You can find more information about the Jenkins Config File Provider Plugin on the official Jenkins website or the plugin's GitHub repository.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:config-file-provider.
