CVE-2023-32982

Name of the Vulnerable Software and Affected Versions Jenkins Ansible Plugin versions 204.v8191fd551eb f and earlier

Description The issue concerns the storage of extra variables, often used to pass secrets, in an unencrypted manner in job config.xml files on the Jenkins controller. These variables can be accessed by users with Item/Extended Read permission or those with access to the Jenkins controller file system. Furthermore, the job configuration form does not mask these extra variables, potentially allowing attackers to observe and capture them.

Recommendations For Jenkins Ansible Plugin versions 204.v8191fd551eb f and earlier, update to version 205.v4cb c48657c21 or later to ensure extra variables are stored encrypted and masked on the configuration form.