CVE-2023-50777

Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier does not mask PaaSLane authentication tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
http://www.openwall.com/lists/oss-security/2023/12/13/4	Mailing List
https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3182	Vendor Advisory
http://www.openwall.com/lists/oss-security/2023/12/13/4	Mailing List
https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3182	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:jenkins:paaslane_estimate:*:*:*:*:*:jenkins:*:*

History

22 May 2025, 19:15

Type	Values Removed	Values Added
CWE		CWE-863

21 Nov 2024, 08:37

Type	Values Removed	Values Added
References	~~() http://www.openwall.com/lists/oss-security/2023/12/13/4 - Mailing List~~	() http://www.openwall.com/lists/oss-security/2023/12/13/4 - Mailing List
References	~~() https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3182 - Vendor Advisory~~	() https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3182 - Vendor Advisory

18 Dec 2023, 19:10

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.3
CPE		cpe:2.3:a:jenkins:paaslane_estimate::::::jenkins::*
First Time		Jenkins Jenkins paaslane Estimate
CWE		CWE-312
References	~~() http://www.openwall.com/lists/oss-security/2023/12/13/4 -~~	() http://www.openwall.com/lists/oss-security/2023/12/13/4 - Mailing List
References	~~() https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3182 -~~	() https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3182 - Vendor Advisory

13 Dec 2023, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-12-13 18:15

Updated : 2025-05-22 19:15

NVD link : CVE-2023-50777

Mitre link : CVE-2023-50777

CVE.ORG link : CVE-2023-50777

JSON object : View

Products Affected

jenkins

paaslane_estimate

CWE

CWE-312

Cleartext Storage of Sensitive Information

CWE-863

Incorrect Authorization

{"id": "CVE-2023-50777", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2023-12-13T18:15:44.377", "references": [{"url": "http://www.openwall.com/lists/oss-security/2023/12/13/4", "tags": ["Mailing List"], "source": "jenkinsci-cert@googlegroups.com"}, {"url": "https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3182", "tags": ["Vendor Advisory"], "source": "jenkinsci-cert@googlegroups.com"}, {"url": "http://www.openwall.com/lists/oss-security/2023/12/13/4", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3182", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-312"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier does not mask PaaSLane authentication tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them."}, {"lang": "es", "value": "Jenkins PaaSLane Estimate Plugin 1.0.4 y versiones anteriores no enmascaran los tokens de autenticaci\u00f3n de PaaSLane que se muestran en el formulario de configuraci\u00f3n del trabajo, lo que aumenta la posibilidad de que los atacantes los observen y capturen."}], "lastModified": "2025-05-22T19:15:37.483", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:paaslane_estimate:*:*:*:*:*:jenkins:*:*", "vulnerable": true, "matchCriteriaId": "C2B18C0B-D630-4999-95DB-96224E105433", "versionEndIncluding": "1.0.4"}], "operator": "OR"}]}], "sourceIdentifier": "jenkinsci-cert@googlegroups.com"}