CVE-2023-43494 json
Jenkins does not exclude sensitive build variables from search
published 2023-09-20 3 y ago modified 2026-09-08 2 mo ago also BIT-jenkins-2023-43494 , EUVD-2023-2391 , GHSA-279f-qwgh-h5mp
- cvss
- 4.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.9%
- EPSS 3.9% chance of exploitation in 30 days, percentile 90%
- public exploits
- 0
- none known
Summary
Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter values) from the search in the build history widget, allowing attackers with Item/Read permission to obtain values of sensitive variables used in builds by iteratively testing different characters until the correct sequence is discovered.
Patch / fix
- maven org.jenkins-ci.main:jenkins-core 2.414.2, 2.424
- bitnami jenkins 2.424.0
- Jenkins Project Jenkins 2.424
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-43494 updated cvss 4.3
jenkins: Builds can be filtered by values of sensitive build variables
-
Red Hat OpenShift Developer Tools and Services jenkinsaffected: no fix available
-
Red Hat OpenShift Container Platform 3.11 jenkinsaffected: no fix planned “Out of support scope”
-
Red Hat OpenShift Container Platform 4 jenkinsaffected: no fix available
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
3.94% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| OSV | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.main:jenkins-core | >=2.50, <2.414.2 >=2.415, <2.424 |
2.414.2 2.424 |
| bitnami | jenkins | >=2.50.0, <2.424.0 |
2.424.0 |
Affected products
- Jenkins Project Jenkins
Classification
- Technology feeds
References
-
github.com
/jenkinsci/jenkins/commit/b8ac8cd4c51511b9f844846ba80a8aed054288c5
web
-
jenkins.io
/security/advisory/2023-09-20/#SECURITY-3261
vendor-advisory, web, advisory
-
openwall.com
/lists/oss-security/2023/09/20/5
web, mailing-list, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-43494
advisory, web
-
github.com
/jenkinsci/jenkins
package
Sources
- CVE List CVE-2023-43494
- GitHub Advisory GHSA-279f-qwgh-h5mp
- NVD CVE-2023-43494
- OSV BIT-jenkins-2023-43494
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.