Vulnerability Details : CVE-2023-41934
Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask (i.e., replace with asterisks) usernames of credentials specified in custom Maven settings in Pipeline build logs if "Treat username as secret" is checked.
Products affected by CVE-2023-41934
- Jenkins » Pipeline Maven Integration » For JenkinsVersions up to, including, (<=) 1330.v18e473854496cpe:2.3:a:jenkins:pipeline_maven_integration:*:*:*:*:*:jenkins:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-41934
0.08%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 25 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-41934
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
3.9
|
1.4
|
NIST |
CWE ids for CVE-2023-41934
-
The product writes sensitive information to a log file.Assigned by: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
References for CVE-2023-41934
-
https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3257
Jenkins Security Advisory 2023-09-06Vendor Advisory
-
http://www.openwall.com/lists/oss-security/2023/09/06/9
oss-security - Multiple vulnerabilities in Jenkins pluginsMailing List;Third Party Advisory
Jump to