Jenkins Encrypted Secrets Exposure Vulnerability in View Configuration

A vulnerability exists in Jenkins versions through 2.499 and LTS through 2.492.1, where encrypted values of secrets are not redacted when the 'config.xml' of views is accessed via the REST API or CLI. This oversight allows users with View/Read permission to view sensitive encrypted information. The issue is similar to a previously reported vulnerability that exposed encrypted secrets in agent configurations to users with Agent/Extended Read permission.

Impact

Exploitation of this vulnerability allows for unauthorized access to encrypted secrets, such as passwords, by users with View/Read permission.

Remediation

Users of Jenkins weekly releases should update to version 2.500, and users of Jenkins LTS should update to version 2.492.2. These versions include the necessary fix to redact encrypted values of secrets in view 'config.xml' when accessed via the REST API or CLI.