CVE-2023-24450

Published: Jan 26, 2023Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

Affected (2)

Products: Jenkins: View Cloner

Jenkins

1 product

View Cloner

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Jenkins View Cloner	Version 1.0
Jenkins View Cloner	Version 1.1

Related CWEs

CWE-312

Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

References (2)

https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2787

Source: jenkinsci-cert@googlegroups.com

Vendor Advisory

https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2787

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.