Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2023-24450: Jenkins View Cloner Plugin 1.1 and Earlier Stores Passwords in Plain Text
CVE-2023-24450 · published 3 years ago
Summary
The Jenkins View Cloner Plugin, used to clone and manage views, stores passwords in plain text in job configuration files on the Jenkins server. This means that anyone with permission to read the job configuration or access to the server's file system can see these passwords. To protect your passwords, update to a newer version of the plugin or restrict access to sensitive areas of your Jenkins server.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | jenkins-ci | org.jenkins-ci.plugins:view-cloner | <= 1.1 |
| – | jenkins | view-cloner |
1.0 1.1 cpe:2.3:a:jenkins:view-cloner:1.0:*:*:*:*:jenkins:*:* |
Original advisory text
Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access ...
Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-256Plaintext Storage of a Password
CWE-312Cleartext Storage of Sensitive Information
Timeline
Published26 Jan 2023
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta