What is CVE-2023-43494?

CVE-2023-43494 is a medium-severity vulnerability in Jenkins. CVSS score: 4.3/10. Published 2023-09-20.

How severe is CVE-2023-43494?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Is CVE-2023-43494 known to be exploited?

6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Jenkins

CVE-2023-43494

Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter values) from the search in the build history widget, allowing attackers with Item/Read permission to obtain values of sensitive variables used in builds by iteratively testing different characters until the correct sequence is discovered.

EPSS: 0.034 (87.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Jenkins
Jenkins Project — versions 0, 2.424, 2.414.2

Public proof-of-concept exploits

References

jenkinsci-cert@googlegroups.com (vendor-advisory, Vendor Advisory)
jenkinsci-cert@googlegroups.com (Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2023-43494?: CVE-2023-43494 is a medium-severity vulnerability in Jenkins. CVSS score: 4.3/10. Published 2023-09-20.
How severe is CVE-2023-43494?: Medium severity. CVSS v3 base score is 4.3 out of 10.
Is CVE-2023-43494 known to be exploited?: 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.