PT-2023-21889 · Jenkins · Jenkins Role-Based Authorization Strategy Plugin+1

Daniel Beck + 1 · Published 2023-03-23 · Updated 2025-02-25 · CVE-2023-28668

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Role-based Authorization Strategy Plugin versions 587.v2872c41fa e51 and earlier

Description The issue allows attackers to have greater access than they are entitled to after a permission is granted and then disabled. This occurs because the plugin grants permissions even after they have been disabled, which can happen when a permission is granted directly or through groups and then disabled, for example, through the script console.

Recommendations For versions 587.v2872c41fa e51 and earlier, consider updating to a version that does not grant disabled permissions, such as 587.588.v850a 20a 30162, to prevent attackers from gaining greater access than intended.

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

CVE-2023-28668

GHSA-436G-2F92-CVHH

Affected Products

Jenkins

Jenkins Role-Based Authorization Strategy Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-28668 · Security Note
• https://jenkins.io/security/advisory/2023-03-21/#SECURITY-3053 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-436g-2f92-cvhh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28668 · Vendor Advisory
• https://github.com/jenkinsci/role-strategy-plugin/commit/850a20a3016276d0c0ba4898a876c113a9191da4 · Note
• https://t.me/cvenotify/112470 · Telegram Post
• https://t.me/cvenotify/47383 · Telegram Post