{"id":"CVE-2023-24450","state":"PUBLISHED","title":"Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permi","description":"Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.","publishedAt":"2023-01-24T00:00:00.000Z","updatedAt":"2025-04-02T13:47:53.636Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"CISA-ADP"},"assigner":"jenkins","products":["Jenkins Project Jenkins view-cloner Plugin"],"affected":[{"vendor":"Jenkins Project","product":"Jenkins view-cloner Plugin","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"1.1","versionType":"custom"},{"version":"next of 1.1","status":"unknown","lessThan":"unspecified","versionType":"custom"}]}],"references":["https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2787"],"weaknesses":["CWE-312"],"ingestedAt":"2026-10-29T20:05:43.909Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/24xxx/CVE-2023-24450.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-24450","state":"PUBLISHED","datePublished":"2023-01-24T00:00:00.000Z","dateUpdated":"2025-04-02T13:47:53.636Z","assignerShortName":"jenkins","assignerOrgId":"39769cd5-e6e2-4dc8-927e-97b3aa056f5b","dateReserved":"2023-01-23T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system."}],"affected":[{"vendor":"Jenkins Project","product":"Jenkins view-cloner Plugin","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"1.1","versionType":"custom"},{"version":"next of 1.1","status":"unknown","lessThan":"unspecified","versionType":"custom"}]}],"references":[{"url":"https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2787"}],"providerMetadata":{"shortName":"jenkins","orgId":"39769cd5-e6e2-4dc8-927e-97b3aa056f5b","dateUpdated":"2023-10-24T12:48:42.431Z"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2787","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T10:56:03.987Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-04-02T13:47:48.991251Z","id":"CVE-2023-24450","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-312","type":"CWE","lang":"en","description":"CWE-312 Cleartext Storage of Sensitive Information"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-02T13:47:53.636Z"}}]}}}