Medium severity4.3NVD Advisory· Published Sep 20, 2023· Updated Jun 17, 2026
CVE-2023-43494
CVE-2023-43494
Description
Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter values) from the search in the build history widget, allowing attackers with Item/Read permission to obtain values of sensitive variables used in builds by iteratively testing different characters until the correct sequence is discovered.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.jenkins-ci.main:jenkins-coreMaven | >= 2.50, < 2.414.2 | 2.414.2 |
org.jenkins-ci.main:jenkins-coreMaven | >= 2.415, < 2.424 | 2.424 |
Affected products
3- osv-coords2 versions
>= 2.50.0, < 2.424.0+ 1 more
- (no CPE)range: >= 2.50.0, < 2.424.0
- (no CPE)range: >= 2.50, < 2.414.2
- Range: 0
Patches
Vulnerability mechanics
References
5- www.openwall.com/lists/oss-security/2023/09/20/5nvdMailing ListThird Party AdvisoryWEB
- github.com/advisories/GHSA-279f-qwgh-h5mpghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-43494ghsaADVISORY
- www.jenkins.io/security/advisory/2023-09-20/nvdVendor AdvisoryWEB
- github.com/jenkinsci/jenkins/commit/b8ac8cd4c51511b9f844846ba80a8aed054288c5ghsaWEB
News mentions
1- Jenkins Security Advisory 2023-09-20Jenkins Security Advisories · Sep 20, 2023