PT-2023-24190 · Jenkins · Jenkins Team Concert Plugin+1

Kevin Guerroudj · Published 2023-06-19 · Updated 2024-12-11 · CVE-2023-3315

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Team Concert Plugin versions 2.4.1 and earlier

Description The issue is related to missing permission checks in the Jenkins Team Concert Plugin, which allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. This is possible due to the lack of permission checks in methods implementing form validation.

Recommendations For Jenkins Team Concert Plugin versions 2.4.1 and earlier, update to version 2.4.2 or later, which requires Overall/Administer permission for the affected form validation methods. As a temporary workaround, consider restricting access to the form validation methods to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-3315

GHSA-HCPW-V727-64QH

Affected Products

Jenkins

Jenkins Team Concert Plugin

References · 6

• https://jenkins.io/security/advisory/2023-06-14/#SECURITY-2932 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hcpw-v727-64qh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3315 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3315 · Vendor Advisory
• https://github.com/jenkinsci/teamconcert-plugin/commit/c77dc8406070edead2a697f26f629465fef72d16 · Note
• https://t.me/cvenotify/52665 · Telegram Post