Executive Summary

The Jenkins Job Configuration History Plugin version 1356.ve360da_6c523a_ and earlier has a vulnerability where it does not redact encrypted secret values when displaying historical job and agent configurations.

This means that attackers who have Extended Read permission can view these encrypted secret values in the configuration history, even though these values are supposed to be hidden or redacted.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers with Extended Read permission to access encrypted secret values that should normally be hidden.

If an attacker can view these secrets, they might be able to misuse sensitive information such as passwords, tokens, or keys stored in the Jenkins job configurations.

This could lead to unauthorized access, privilege escalation, or compromise of other systems that rely on these secrets.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows attackers with Extended Read permission to view encrypted secret values that should otherwise be redacted in historical job and agent configurations.

Exposure of encrypted secrets could lead to unauthorized access to sensitive information, which may impact compliance with data protection standards such as GDPR and HIPAA that require protection of sensitive data.

However, specific impacts on compliance are not detailed in the provided information.

Useful 0 Not Useful 0