CVE-2023-33001

CWE-532 — Log File Information Exposure5 documents5 sources
Severity
7.5HIGH
EPSS
0.6%
top 30.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Jenkins Hashicorp Vault PluginJenkins Hashicorp Vault
Timeline
PublishedMay 16

Description

Jenkins HashiCorp Vault Plugin 360.v0a_1c04cf807d and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDjenkins/hashicorp_vault360.v0a_1c04cf807d

🔴Vulnerability Details

3
GHSA
Jenkins HashiCorp Vault Plugin has improper masking of credentials↗2023-05-16
▶
CVEList
CVE-2023-33001: Jenkins HashiCorp Vault Plugin 360↗2023-05-16
▶
OSV
Jenkins HashiCorp Vault Plugin has improper masking of credentials↗2023-05-16
▶

📋Vendor Advisories

1
Jenkins
Jenkins Security Advisory 2023-05-16↗2023-05-16
▶
CVE-2023-33001 (HIGH CVSS 7.5) | Jenkins HashiCorp Vault Plugin 360. | cvebase.io