PT-2023-25166 · Jenkins · Jenkins Aws Codecommit Trigger Plugin+1

Atorralba + 1 · Publicado 2023-06-14 · Atualizado 2024-12-31 · CVE-2023-35147

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins AWS CodeCommit Trigger Plugin versions 3.0.12 and earlier

Description The issue allows attackers with Item/Read permission to obtain the contents of arbitrary files on the Jenkins controller file system due to the lack of restriction on the AWS SQS queue name path parameter in an HTTP endpoint.

Recommendations For Jenkins AWS CodeCommit Trigger Plugin versions 3.0.12 and earlier, consider restricting access to the HTTP endpoint until a patch is available. As a temporary workaround, restrict the Item/Read permission to minimize the risk of exploitation.

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2023-35147

GHSA-WHGJ-6M78-2GG9

Produtos afetados

Jenkins

Jenkins Aws Codecommit Trigger Plugin

Referências · 7

• https://t.me/cvenotify/105871 · Publicação no Telegram
• https://jenkins.io/security/advisory/2023-06-14/#SECURITY-3099 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-35147 · Nota de Segurança
• http://openwall.com/lists/oss-security/2023/06/14/5 · Nota
• https://osv.dev/vulnerability/CVE-2023-35147 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-whgj-6m78-2gg9 · Aviso do Fabricante
• https://t.me/cvenotify/52300 · Publicação no Telegram