PT-2023-28183 · Jenkins · Jenkins Assembla Auth Plugin+1

Yaroslav Afenkin · Publicado 2023-09-06 · Atualizado 2023-09-11 · CVE-2023-41945

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Assembla Auth Plugin versions 1.14 and earlier

Description The issue results in users with EDIT permissions being granted Overall/Manage and Overall/SystemRead permissions, even if those permissions are disabled and should not be granted. This occurs because the plugin does not verify that the permissions it grants are enabled.

Recommendations For Jenkins Assembla Auth Plugin versions 1.14 and earlier, update to a version that includes the fix for this issue to prevent users with EDIT permissions from being granted unnecessary permissions.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2023-41945

GHSA-QF42-F5VF-6W99

Produtos afetados

Jenkins

Jenkins Assembla Auth Plugin

Referências · 9

• https://jenkins.io/security/advisory/2023-09-06/#SECURITY-3065 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-41945 · Nota de Segurança
• https://t.me/cvenotify/57625 · Publicação no Telegram
• https://t.me/cibsecurity/70011 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1699437242215739403 · Publicação no Twitter
• http://openwall.com/lists/oss-security/2023/09/06/9 · Nota
• https://osv.dev/vulnerability/GHSA-qf42-f5vf-6w99 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1699416748523765816 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-41945 · Aviso do Fabricante