CVE-2023-40343

2023-08-1615:15:11

CWE-203

jenkins

web.nvd.nist.gov

2666

cve-2023-40343

jenkins

tuleap

authentication plugin

security vulnerability

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

50.6%

JSON

Jenkins Tuleap Authentication Plugin 1.1.20 and earlier uses a non-constant time comparison function when validating an authentication token allowing attackers to use statistical methods to obtain a valid authentication token.

Affected configurations

Nvd

Node

jenkinstuleap_authenticationRange≤1.1.20jenkins

VendorProductVersionCPE
jenkinstuleap_authentication*cpe:2.3:a:jenkins:tuleap_authentication:*:*:*:*:*:jenkins:*:*

Vendor	Product	Version	CPE
jenkins	tuleap_authentication	*	cpe:2.3:a:jenkins:tuleap_authentication::::::jenkins::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Jenkins Tuleap Authentication Plugin",
    "vendor": "Jenkins Project",
    "versions": [
      {
        "lessThanOrEqual": "1.1.20",
        "status": "affected",
        "version": "0",
        "versionType": "maven"
      }
    ]
  }
]