CVE-2023-40340 Jenkins NodeJS Plugin improper credential masking vulnerability
Attackers can view unmasked credentials in Jenkins Pipeline build logs due to improper masking in the NodeJS Plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-40340?
CVE-2023-40340 is a high-severity vulnerability in Jenkins NodeJS Plugin, published on 16 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jenkins NodeJS Plugin 1.6.0 and earlier does not properly mask (i.e., replace with asterisks) credentials specified in the Npm config file in Pipeline build logs.
Which versions are affected by CVE-2023-40340?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:nodejs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:nodejs Maven | All versions | 1.6.1 |
org.jenkins-ci.plugins:nodejs Maven | All versions | 1.6.1 |
Products include Jenkins Nodejs.
How do I fix CVE-2023-40340?
Upgrade org.jenkins-ci.plugins:nodejs to 1.6.1 or later.
Is CVE-2023-40340 being exploited?
There is no known exploitation of CVE-2023-40340 in the wild and no public exploit code.
Sources
Also known as GHSA-36fg-whr2-g999.