PT-2023-3617 · Micro Focus · Dimensions Plugin

Kevin Guerroudj + 1 · Publicado 2023-06-15 · Atualizado 2023-07-28 · CVE-2023-32262

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dimensions Plugin versions 0.9.3 and earlier

Description A potential issue has been identified in the Micro Focus Dimensions CM Plugin for Jenkins, related to information disclosure. This issue allows attackers with Item/Configure permission to access and capture credentials they are not entitled to. The exploitation of this issue may permit a remote attacker to gain unauthorized access to protected information.

Recommendations For Dimensions Plugin versions 0.9.3 and earlier, update to version 0.9.3.1 to define the appropriate context for credentials lookup, preventing the use of System-scoped credentials otherwise reserved for the global configuration.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2023-03901

CVE-2023-32262

GHSA-PX39-5H8C-J3C8

Produtos afetados

Dimensions Plugin

Referências · 9

• https://portal.microfocus.com/s/article/KM000019298 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-px39-5h8c-j3c8 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-32262 · Nota de Segurança
• https://jenkins.io/security/advisory/2023-06-14 · Nota
• https://plugins.jenkins.io/dimensionsscm · Nota
• https://bdu.fstec.ru/vul/2023-03901 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-32262 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2023-06-14/#SECURITY-3143 · Nota
• https://cybersecurity-help.cz/vdb/SB2023061633 · Nota