MEDIUM✓ PATCH🇬🇧 English

CVE-2023-30523

CVSS 4.3v3.1pub. 2023-04-12upd. 2025-02-07

Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

  • Jenkins Report Portal

    APP
    Jenkins
    ≤ 0.5
🟢
PATCH DOSTĘPNY
Aktualizacja od producenta gotowa. Wdrożenie w ramach standardowego cyklu.
Tagi
CI/CD
CWE
Referencje

Powiązane podatności

CVE-2023-30525HIGH8.8ten sam produkt

A cross-site request forgery (CSRF) vulnerability in Jenkins Report Portal Plugin 0.5 and earlier allows attac...

CVE-2023-30524MEDIUM4.3ten sam produkt

Jenkins Report Portal Plugin 0.5 and earlier does not mask ReportPortal access tokens displayed on the configu...

CVE-2023-30526MEDIUM6.5ten sam produkt

A missing permission check in Jenkins Report Portal Plugin 0.5 and earlier allows attackers with Overall/Read ...

CVE-2024-23897CRITICAL9.8⚠ KEVPL ✓ten sam vendor

Jenkins CLI – odczyt dowolnych plików przez path traversal bez uwierzytelnienia

CVE-2019-1003029CRITICAL9.9⚠ KEVten sam vendor

A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/...