CVE-2023-32982

See a problem?

Source

https://nvd.nist.gov/vuln/detail/CVE-2023-32982

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-32982.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-32982

Aliases

GHSA-38hw-368m-7jmg

Published

2023-05-16T16:15:10Z

Modified

2024-09-03T04:30:50.898835Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

[none]

Details

Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier stores extra variables unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

References

https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3017

Affected packages

Git / github.com/jenkinsci/ansible-plugin

Affected ranges

Type: GIT
Repo: https://github.com/jenkinsci/ansible-plugin
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

8191fd551ebf606556c730a08eb1d74426dc6257

Affected versions

146.*

146.v431a_a_39d472d

148.*

148.v6b_13c6de3a_47

174.*

174.vfd5323d2b_9d8

204.*

204.v8191fd551eb_f

ansible-0.*

ansible-0.1

ansible-0.2

ansible-0.3

ansible-0.3.1

ansible-0.4

ansible-0.5

ansible-0.6

ansible-0.6.1

ansible-0.6.2

ansible-0.7

ansible-0.8

ansible-1.*

ansible-1.0

ansible-1.1