{"id":"CVE-2023-43494","details":"Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter values) from the search in the build history widget, allowing attackers with Item/Read permission to obtain values of sensitive variables used in builds by iteratively testing different characters until the correct sequence is discovered.","aliases":["BIT-jenkins-2023-43494","GHSA-279f-qwgh-h5mp"],"modified":"2026-08-18T17:25:54.445885Z","published":"2023-09-20T17:15:11.667Z","references":[{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2023/09/20/5"},{"type":"ADVISORY","url":"https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3261"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jenkinsci/jenkins","events":[{"introduced":"c71a9ef88b0ad1aa33662545ecf91068df57ce79"},{"fixed":"4e4eba6c30a3882e33c27fde0b6f158f5408a73f"},{"introduced":"adbd903f9313bda508636da43beaabb54686a1a1"},{"fixed":"bd407f22c64575da34a715784a55ccc91c5c64fc"}],"database_specific":{"cpe":["cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*","cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*"],"extracted_events":[{"introduced":"2.50"},{"fixed":"2.424"},{"introduced":"2.60.1"},{"fixed":"2.414.2"}],"source":"CPE_RANGE"}}],"versions":["jenkins-2.423","jenkins-2.414.2-rc","jenkins-2.422","jenkins-2.421","jenkins-2.414.1","jenkins-2.414.1-rc","jenkins-2.420","jenkins-2.419","jenkins-2.418","jenkins-2.417","jenkins-2.416","jenkins-2.415","jenkins-2.414","jenkins-2.413","jenkins-2.412","jenkins-2.411","jenkins-2.410","jenkins-2.409","jenkins-2.408","jenkins-2.407","jenkins-2.406","jenkins-2.405","jenkins-2.404","jenkins-2.403","jenkins-2.402","jenkins-2.401","jenkins-2.400","jenkins-2.399","jenkins-2.398","jenkins-2.397","jenkins-2.396","jenkins-2.395","jenkins-2.394","jenkins-2.393","jenkins-2.392","jenkins-2.391","jenkins-2.390","jenkins-2.389","jenkins-2.388","jenkins-2.387","jenkins-2.386","jenkins-2.385","jenkins-2.384","jenkins-2.383","jenkins-2.382","jenkins-2.381","jenkins-2.380","jenkins-2.379","jenkins-2.378","jenkins-2.377","jenkins-2.376","jenkins-2.375","jenkins-2.374","jenkins-2.373","jenkins-2.372","jenkins-2.371","jenkins-2.369","jenkins-2.368","jenkins-2.367","jenkins-2.366","jenkins-2.365","jenkins-2.364","jenkins-2.363","jenkins-2.362","jenkins-2.361","jenkins-2.360","jenkins-2.359","jenkins-2.358","jenkins-2.357","jenkins-2.356","jenkins-2.355","jenkins-2.354","jenkins-2.353","jenkins-2.352","jenkins-2.351","jenkins-2.350","jenkins-2.349","jenkins-2.348","jenkins-2.347","jenkins-2.346","jenkins-2.345","jenkins-2.344","jenkins-2.343","jenkins-2.342","jenkins-2.341","jenkins-2.340","jenkins-2.339","jenkins-2.338","jenkins-2.337","jenkins-2.336","jenkins-2.335","jenkins-2.334","jenkins-2.333","jenkins-2.332","jenkins-2.331","jenkins-2.330","jenkins-2.329","jenkins-2.328","jenkins-2.327","jenkins-2.326","jenkins-2.325","jenkins-2.324","jenkins-2.323","jenkins-2.322","jenkins-2.321","jenkins-2.320","jenkins-2.319","jenkins-2.318","jenkins-2.317","jenkins-2.316","jenkins-2.314","jenkins-2.313","jenkins-2.312","jenkins-2.311","jenkins-2.310","jenkins-2.309","jenkins-2.308","jenkins-2.307","jenkins-2.306","jenkins-2.305","jenkins-2.304","jenkins-2.303","jenkins-2.302","jenkins-2.301","jenkins-2.299","jenkins-2.298","jenkins-2.297","jenkins-2.296","jenkins-2.295","jenkins-2.294","jenkins-2.293","jenkins-2.292","jenkins-2.289","jenkins-2.291","jenkins-2.290","jenkins-2.288","jenkins-2.287","jenkins-2.286","jenkins-2.285","jenkins-2.284","jenkins-2.283","jenkins-2.282","jenkins-2.281","jenkins-2.280","jenkins-2.279","jenkins-2.278","jenkins-2.277","jenkins-2.276","jenkins-2.274","jenkins-2.273","jenkins-2.272","jenkins-2.271","jenkins-2.270","jenkins-2.269","jenkins-2.268","jenkins-2.267","jenkins-2.266","jenkins-2.265","jenkins-2.264","jenkins-2.263","jenkins-2.262","jenkins-2.261","jenkins-2.260","jenkins-2.259","jenkins-2.258","jenkins-2.257","jenkins-2.256","jenkins-2.255","jenkins-2.254","jenkins-2.253","jenkins-2.251","jenkins-2.250","jenkins-2.249","jenkins-2.248","jenkins-2.247","jenkins-2.246","jenkins-2.245","jenkins-2.236","jenkins-2.235","jenkins-2.234","jenkins-2.233","jenkins-2.232","jenkins-2.231","jenkins-2.230","jenkins-2.229","jenkins-2.228","jenkins-2.219","jenkins-2.205","jenkins-2.204","jenkins-2.203","jenkins-2.202","jenkins-2.201","jenkins-2.200","jenkins-2.199","jenkins-2.198","jenkins-2.197","jenkins-2.192","jenkins-2.186","jenkins-2.174","jenkins-2.173","jenkins-2.172","jenkins-2.165","jenkins-2.164","jenkins-2.163","jenkins-2.162","jenkins-2.161","jenkins-2.160","jenkins-2.156","jenkins-2.155","jenkins-2.154","jenkins-2.151","jenkins-2.150","jenkins-2.149","jenkins-2.148","jenkins-2.147","jenkins-2.146","jenkins-2.143","jenkins-2.142","jenkins-2.141","jenkins-2.140","jenkins-2.138","jenkins-2.135","jenkins-2.134","jenkins-2.132","jenkins-2.131","jenkins-2.130","jenkins-2.129","jenkins-2.128","jenkins-2.127","jenkins-2.126","jenkins-2.125","jenkins-2.124","jenkins-2.122","jenkins-2.121","jenkins-2.118","jenkins-2.117","jenkins-2.116","jenkins-2.109","jenkins-2.108","jenkins-2.106","jenkins-2.105","jenkins-2.104","jenkins-2.103","jenkins-2.102","jenkins-2.101","jenkins-2.100","jenkins-2.99","jenkins-2.98","jenkins-2.97","jenkins-2.96","jenkins-2.95","jenkins-2.68","jenkins-2.67","jenkins-2.66","jenkins-2.65","jenkins-2.64","jenkins-2.63","jenkins-2.60","jenkins-2.62","jenkins-2.61","jenkins-2.59","jenkins-2.58","jenkins-2.57","jenkins-2.53","jenkins-2.52","jenkins-2.51","jenkins-2.50"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-43494.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}]}