Advisory details:
github_osv / GHSA-6hw7-x86v-wrgf
| Advisory ID | github_osv/GHSA-6hw7-x86v-wrgf |
| Aliases |
CVE-2023-24450
|
| Summary | Passwords stored in plain text by Jenkins view-cloner Plugin Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 5.9 |
| Risk | 3.0 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 6.5 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-6hw7-x86v-wrgf/GHSA-6hw7-x86v-wrgf.json |
| generic_textual | MODERATE |
| Reference id | Reference type | URL |
|---|---|---|
| https://github.com/jenkinsci/view-cloner-plugin | ||
| https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2787 | ||
| CVE-2023-24450 | https://nvd.nist.gov/vuln/detail/CVE-2023-24450 |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-02T13:47:48Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2023/24xxx/CVE-2023-24450.json
Source Advisory: vulnrichment/CVE-2023-24450
[{'Exploitation': 'none'},
{'Automatable': 'no'},
{'Technical Impact': 'partial'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]