CVE-2023-24439

2023-01-2400:00:00

jenkins

www.cve.org

jenkins

jira pipeline

private keys

unencrypted

global configuration file

file system.

0.0004 Low

EPSS

Percentile

9.1%

JSON

Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

CNA Affected

[
  {
    "product": "Jenkins JIRA Pipeline Steps Plugin",
    "vendor": "Jenkins Project",
    "versions": [
      {
        "lessThanOrEqual": "2.0.165.v8846cf59f3db",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "unknown",
        "version": "next of 2.0.165.v8846cf59f3db",
        "versionType": "custom"
      }
    ]
  }
]

References

www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2774

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for CVELIST:CVE-2023-24439