Information disclosure in Config File Provider - CVE-2023-40339

Vulnerability identifier: #VU79888

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-40339

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to improper masking of credentials. A remote user can gain unauthorized access to sensitive information on the system.

Config File Provider
OpenShift Developer Tools and Services
IBM Cloud Pak for Business Automation
jenkins (Red Hat package)
jenkins-2-plugins (Red Hat package)

Install updates from vendor's website.

Config File Provider - update to 953.v0432a_802e4d2
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.26, 23.0.1.4
jenkins (Red Hat package) - addressed in versions 2.426.3.1706515686-3.el8, 2.426.3.1706516352-3.el8
jenkins-2-plugins (Red Hat package) - addressed in versions 4.12.1706515741-1.el8, 4.14.1706516441-1.el8

• https://jenkins.io/security/advisory/2023-08-16/

• Information disclosure in Jenkins Config File Provider plugin
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• OpenShift Developer Tools and Services for OCP 4.14 update for jenkins and jenkins-2-plugins
• OpenShift Developer Tools and Services for OCP 4.12 update for Jenkins and Jenkins-2-plugins