CVE-2023-43494
MEDIUMJenkins 2.50-2.423 LTS 2.60.1-2.414.1 - Info Disclosure
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2023-43494. PoCs published by mqxmm.
AI-analyzed exploit summary The repository contains a Python script that checks for the presence of CVE-2023-43494 in Jenkins by sending a crafted HTTP request and analyzing the response for a specific table structure. It does not exploit the vulnerability but scans for its presence.
Description
Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter values) from the search in the build history widget, allowing attackers with Item/Read permission to obtain values of sensitive variables used in builds by iteratively testing different characters until the correct sequence is discovered.
Exploits (1)
The repository contains a Python script that checks for the presence of CVE-2023-43494 in Jenkins by sending a crafted HTTP request and analyzing the response for a specific table structure. It does not exploit the vulnerability but scans for its presence.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N