GitHub Advisoryadvisory · Maven

GHSA-66hv-fhcm-7xm7 Jenkins Warnings Plugin exposures system-scoped credentials

MEDIUM Published 2023-10-25 Modified 2023-11-02 Official page ↗
Aliases
CVE-2023-46651
Ecosystem
Maven
Packages
io.jenkins.plugins:warnings-ng
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-522
Reviewed
2023-10-30

Affected packages

• Maven io.jenkins.plugins:warnings-ng: >= 10.5.0, < 10.5.1 → fixed in 10.5.1 • Maven io.jenkins.plugins:warnings-ng: < 10.4.1 → fixed in 10.4.1

Description

Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing the use of system-scoped credentials otherwise reserved for the global configuration. This allows attackers with Item/Configure permission to access and capture credentials they are not entitled to. Warnings Plugin 10.5.1 defines the appropriate context for credentials lookup. This fix has been backported to 10.4.1.

Related

Alias · CVE (1)

  • CVE-2023-46651 Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing attackers with… vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References