CVE-2023-40340

Summary

Jenkins NodeJS Plugin 1.6.0 and earlier does not properly mask (i.e., replace with asterisks) credentials specified in the Npm config file in Pipeline build logs.

Affected Software

Weaknesses

ADP Enrichment

CVE Program Container

Additional References

• https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3196
• http://www.openwall.com/lists/oss-security/2023/08/16/3

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3196
• http://www.openwall.com/lists/oss-security/2023/08/16/3

• ←Previous
• Next→