CVE-2023-43494

Deeper analysis

Jenkins versions 2.50 through 2.423 and LTS releases 2.60.1 through 2.414.1 fail to exclude sensitive build variables such as password parameter values from searches performed in the build history widget. This information disclosure issue stems from the way the widget indexes and returns build data without filtering protected parameters.

Attackers holding Item/Read permission on a job can exploit the flaw by repeatedly querying the widget with different character sequences until the correct values of sensitive variables are reconstructed. The technique requires no other privileges and yields partial disclosure of credentials or secrets used during builds, consistent with the reported CVSS score of 4.3.

The Jenkins security advisory published on 2023-09-20 along with the accompanying oss-security postings describe the issue under SECURITY-3261 and direct administrators to the corresponding updates that address the exposure in later releases.

The EPSS score reached a peak of 0.5327 before receding to its current value of 0.4915, indicating moderate ongoing interest without evidence of widespread active exploitation.