CVE-2023-33000
published 2023-05-16CVE-2023-33000: Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier does not mask credentials displayed on the configuration form, increasing the…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.57%
46.5th percentile
Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier does not mask credentials displayed on the configuration form, increasing the potential for attackers to observe and capture them.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | ansible_plugin | — | — |
| jenkins | appspider_plugin | — | — |
| jenkins | azure_vm_agents_plugin | — | — |
| jenkins | cas_plugin | — | — |
| jenkins | code_dx_plugin | — | — |
| jenkins | credentials_plugin | — | — |
| jenkins | email_extension_plugin | — | — |
| jenkins | file_parameter_plugin | — | — |
| jenkins | hashicorp_vault_plugin | — | — |
| jenkins | ids_in_azure_vm_agents_plugin | — | — |
| jenkins | improper_masking_of_credentials_in_hashicorp_vault_plugin | — | — |
| jenkins | job_plugin | — | — |
| jenkins | ldap_plugin | — | — |
| jenkins | loadcomplete_support_plugin | — | — |
| jenkins | ns-nd_integration_performance_publisher | <= 4.8.0.149 | — |
| jenkins | ns-nd_integration_performance_publisher_plugin | — | — |
| jenkins | pipeline_utility_steps_plugin | — | — |
| jenkins | reverse_proxy_auth_plugin | — | — |
| jenkins | sidebar_link_plugin | — | — |
| jenkins | tag_profiler_plugin | — | — |
| jenkins | testcomplete_support_plugin | — | — |
| jenkins | testng_report_files_and_displayed_on_the_plugin | — | — |
| jenkins | testng_results_plugin | — | — |
| jenkins_project | jenkins_ns-nd_integration_performance_publisher_plugin | <= 4.8.0.149 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Jenkins NS-ND Integration Performance Publisher Plugin displays credentials without masking
osv·2023-05-16
CVE-2023-33000 [LOW] Jenkins NS-ND Integration Performance Publisher Plugin displays credentials without masking
Jenkins NS-ND Integration Performance Publisher Plugin displays credentials without masking
Jenkins NS-ND Integration Performance Publisher Plugin stores credentials in job config.xml files on the Jenkins controller as part of its configuration.
While these credentials are stored encrypted on disk, in NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier, the job configuration form does not mask these credentials, increasing the potential for attackers to observe and capture them.
NS-ND Integration Performance Publisher Plugin 4.11.0.48 masks credentials displayed on the configuration form.
GHSA
Jenkins NS-ND Integration Performance Publisher Plugin displays credentials without masking
ghsa·2023-05-16
CVE-2023-33000 [LOW] CWE-522 Jenkins NS-ND Integration Performance Publisher Plugin displays credentials without masking
Jenkins NS-ND Integration Performance Publisher Plugin displays credentials without masking
Jenkins NS-ND Integration Performance Publisher Plugin stores credentials in job config.xml files on the Jenkins controller as part of its configuration.
While these credentials are stored encrypted on disk, in NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier, the job configuration form does not mask these credentials, increasing the potential for attackers to observe and capture them.
NS-ND Integration Performance Publisher Plugin 4.11.0.48 masks credentials displayed on the configuration form.
Jenkins
Jenkins Security Advisory 2023-05-16
vendor_jenkins·2023-05-16·CVSS 5.4
CVE-2023-2195 [MEDIUM] Jenkins Security Advisory 2023-05-16
Title: Jenkins Security Advisory 2023-05-16
Jenkins Security Advisory 2023-05-16
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Ansible
Plugin
AppSpider
Plugin
Azure VM Agents
Plugin
CAS
Plugin
Code Dx
Plugin
Email Extension
Plugin
File Parameter
Plugin
HashiCorp Vault
Plugin
LDAP
Pl
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-05-16
Published