CVE-2023-40339

2023-08-1614:32:51

jenkins

www.cve.org

jenkins

config file provider

plugin

credentials

build log

cve-2023-40339

AI Score

7.8

Confidence

High

EPSS

0.001

Percentile

49.1%

JSON

Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files when they’re written to the build log.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Jenkins Config File Provider Plugin",
    "vendor": "Jenkins Project",
    "versions": [
      {
        "lessThan": "*",
        "status": "unaffected",
        "version": "953.v0432a_802e4d2",
        "versionType": "maven"
      },
      {
        "status": "unaffected",
        "version": "951.953.vdfc5f6e2dcc4"
      }
    ]
  }
]