5.5
Medium
CVE-2023-24439 Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global…
Description
Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins JIRA Pipeline Steps Plugin 2.0 | earliest → 2.0.165.v8846cf59f3db | No fix stated |
Other CVEs of Jenkins JIRA Pipeline Steps Plugin
The 4 CVEs of Jenkins JIRA Pipeline Steps Plugin →
CVE-2023-24440
Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part…
5.5
Medium
CVE-2023-24437
A cross-site request forgery (CSRF) vulnerability in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and…
8.8
High
CVE-2023-24438
A missing permission check in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers with…
6.5
Medium