PT-2023-28177 · Jenkins · Jenkins Ssh2 Easy Plugin+1

Kevin Guerroudj + 1 · Published 2023-09-06 · Updated 2024-09-26 · CVE-2023-41939

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins SSH2 Easy Plugin versions 1.4 and earlier

Description The issue is related to the verification of permissions configured to be granted. It potentially allows users who were formerly granted certain permissions, such as Overall/Manage, to access functionality they are no longer entitled to. This is because the plugin does not verify that these permissions are enabled.

Recommendations For Jenkins SSH2 Easy Plugin versions 1.4 and earlier, consider updating to a version that includes the fix for this issue, as the current version does not properly verify permissions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

CVE-2023-41939

GHSA-4GH2-M88H-8CJ8

Affected Products

Jenkins

Jenkins Ssh2 Easy Plugin

References · 9

• https://jenkins.io/security/advisory/2023-09-06/#SECURITY-3064 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-41939 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41939 · Security Note
• https://osv.dev/vulnerability/GHSA-4gh2-m88h-8cj8 · Vendor Advisory
• https://t.me/cvenotify/57980 · Telegram Post
• http://openwall.com/lists/oss-security/2023/09/06/9 · Note
• https://twitter.com/VulmonFeeds/status/1699433443602371046 · Twitter Post
• https://t.me/cibsecurity/70009 · Telegram Post
• https://twitter.com/CVEnew/status/1699416754890711357 · Twitter Post