PT-2023-28177 · Jenkins · Jenkins Ssh2 Easy Plugin+1

Kevin Guerroudj + 1 · Publicado 2023-09-06 · Atualizado 2024-09-26 · CVE-2023-41939

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins SSH2 Easy Plugin versions 1.4 and earlier

Description The issue is related to the verification of permissions configured to be granted. It potentially allows users who were formerly granted certain permissions, such as Overall/Manage, to access functionality they are no longer entitled to. This is because the plugin does not verify that these permissions are enabled.

Recommendations For Jenkins SSH2 Easy Plugin versions 1.4 and earlier, consider updating to a version that includes the fix for this issue, as the current version does not properly verify permissions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Preservation of Permissions

Enumeração de Fraquezas

CWE-281

Identificadores relacionados

CVE-2023-41939

GHSA-4GH2-M88H-8CJ8

Produtos afetados

Jenkins

Jenkins Ssh2 Easy Plugin

Referências · 9

• https://jenkins.io/security/advisory/2023-09-06/#SECURITY-3064 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-41939 · Aviso do Fabricante
• https://t.me/cvenotify/57980 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-41939 · Nota de Segurança
• http://openwall.com/lists/oss-security/2023/09/06/9 · Nota
• https://osv.dev/vulnerability/GHSA-4gh2-m88h-8cj8 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1699433443602371046 · Publicação no Twitter
• https://t.me/cibsecurity/70009 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1699416754890711357 · Publicação no Twitter