CVE-2023-30530 Jenkins Consul KV Builder Plugin stores HashiCorp Consul ACL Token unencrypted
Attackers with Jenkins controller file system access can read unencrypted HashiCorp Consul ACL tokens stored by the plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-30530?
CVE-2023-30530 is a medium-severity vulnerability in Jenkins Consul KV Builder Plugin, published on 12 Apr 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Weakness: CWE-312
Which versions are affected by CVE-2023-30530?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:consul-kv-builder. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:consul-kv-builder Maven | All versions to 2.0.13 | None |
org.jenkins-ci.plugins:consul-kv-builder Maven | All versions to 2.0.13 | None |
Products include Jenkins Consul Kv Builder.
How do I fix CVE-2023-30530?
No fix has been published for CVE-2023-30530 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-30530 being exploited?
There is no known exploitation of CVE-2023-30530 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Consul KV Builder Plugin
Sources
Also known as GHSA-96c7-fqxv-rmv7.