CVE-2023-43494

Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter values) from the search in the build history widget, allowing attackers with Item/Read permission to obtain values of sensitive variables used in builds by iteratively testing different characters until the correct sequence is discovered.

• http://www.openwall.com/lists/oss-security/2023/09/20/5Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3261Vendor Advisory
• http://www.openwall.com/lists/oss-security/2023/09/20/5Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3261Vendor Advisory

Published

Sep 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-43489Improper access control for some Intel(R) CIP software befor…5.5
• CVE-2023-4349Use after free in Device Trust Connectors in Google Chrome p…8.8
• CVE-2023-43490Incorrect calculation in microcode keying mechanism for some…5.3
• CVE-2023-43491An information disclosure vulnerability exists in the web in…7.5
• CVE-2023-43492 In Weintek's cMT3000 HMI Web CGI device, the cgi-bi…9.8
• CVE-2023-43493SQL injection vulnerability in Item List page of Welcart e-C…4.9
• CVE-2023-43495Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not …5.4
• CVE-2023-43496Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a…8.8
• CVE-2023-43497In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, proce…8.1
• CVE-2023-43498In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, proce…8.1
• CVE-2023-43499Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does…5.4
• CVE-2023-4350Inappropriate implementation in Fullscreen in Google Chrome …6.5