CVE-2023-40343
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
The Tuleap Authentication Plugin for Jenkins version 1.1.20 and earlier uses a non-constant time comparison function when validating an authentication token. This allows attackers to use statistical methods to obtain a valid authentication token.
Risk Assessment
Attackers can exploit this vulnerability to gain access to the system, potentially leading to unauthorized access to organizational data and resources.
Recommendation
It is recommended to update the Tuleap plugin to the latest version to eliminate this vulnerability and implement additional security measures to protect against statistical-based attacks.
Original NVD description (English source)
Jenkins Tuleap Authentication Plugin 1.1.20 and earlier uses a non-constant time comparison function when validating an authentication token allowing attackers to use statistical methods to obtain a valid authentication token.