CVE-2023-32982
Published: 16 May 2023
Summary
CVE-2023-32982 is a medium-severity Missing Encryption of Sensitive Data (CWE-311) vulnerability in Jenkins Ansible. Its CVSS base score is 4.3 (Medium).
Operationally, ranked at the 48.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-1458
Vulnerability details
Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier stores extra variables unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Privacy and security training stresses encryption of sensitive data, reducing missing encryption weaknesses.
The map highlights data actions that involve sensitive data, enabling identification of missing encryption requirements.
Settings can require encryption of sensitive data, preventing missing encryption weaknesses.
Exchange agreements must document security requirements, which would include encryption to protect sensitive data in transit.
Policy requires protection measures such as encryption for sensitive data stored on media, preventing cleartext exposure.
Architectures must describe confidentiality protections, which includes mandating encryption for sensitive data in transit and at rest.
Privacy and security curricula stress encryption requirements, reducing missing encryption of sensitive data.
Requires encryption and similar controls for CUI processed or stored externally, preventing missing encryption of sensitive data.