PT-2023-28183 · Jenkins · Jenkins Assembla Auth Plugin+1

Yaroslav Afenkin · Published 2023-09-06 · Updated 2023-09-11 · CVE-2023-41945

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Assembla Auth Plugin versions 1.14 and earlier

Description The issue results in users with EDIT permissions being granted Overall/Manage and Overall/SystemRead permissions, even if those permissions are disabled and should not be granted. This occurs because the plugin does not verify that the permissions it grants are enabled.

Recommendations For Jenkins Assembla Auth Plugin versions 1.14 and earlier, update to a version that includes the fix for this issue to prevent users with EDIT permissions from being granted unnecessary permissions.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-41945

GHSA-QF42-F5VF-6W99

Affected Products

Jenkins

Jenkins Assembla Auth Plugin

References · 9

• https://jenkins.io/security/advisory/2023-09-06/#SECURITY-3065 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41945 · Security Note
• https://osv.dev/vulnerability/GHSA-qf42-f5vf-6w99 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-41945 · Vendor Advisory
• https://t.me/cvenotify/57625 · Telegram Post
• https://t.me/cibsecurity/70011 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1699437242215739403 · Twitter Post
• http://openwall.com/lists/oss-security/2023/09/06/9 · Note
• https://twitter.com/CVEnew/status/1699416748523765816 · Twitter Post