Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Jenkins Consul KV Builder Plugin exposes sensitive Consul token

CVE-2023-30531 · published 3 years ago
Summary

A security issue in Jenkins Consul KV Builder Plugin allows attackers to see sensitive Consul credentials. If not addressed, an attacker could use this information to access your Consul environment. Update to Jenkins Consul KV Builder Plugin 2.0.14 or later to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
maven jenkins-ci org.jenkins-ci.plugins:consul-kv-builder <= 2.0.13
– jenkins consul_kv_builder <= 2.0.13
cpe:2.3:a:jenkins:consul_kv_builder:*:*:*:*:*:jenkins:*:*
Original advisory text
Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not mask the HashiCorp Consul ACL Token on the global configuration form, increasing the potential for attackers to observe and capture it.
Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not mask the HashiCorp Consul ACL Token on the global configuration form, increasing the potential for attackers to observe and capture it.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-312Cleartext Storage of Sensitive Information
Timeline
Published12 Apr 2023
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-54cw-rvr3-w6cx · GHSA
CVE-2023-30531 · NVD
Track software like this
Free during beta