PT-2023-3617 · Micro Focus · Dimensions Plugin

Kevin Guerroudj + 1 · Published 2023-06-15 · Updated 2023-07-28 · CVE-2023-32262

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dimensions Plugin versions 0.9.3 and earlier

Description A potential issue has been identified in the Micro Focus Dimensions CM Plugin for Jenkins, related to information disclosure. This issue allows attackers with Item/Configure permission to access and capture credentials they are not entitled to. The exploitation of this issue may permit a remote attacker to gain unauthorized access to protected information.

Recommendations For Dimensions Plugin versions 0.9.3 and earlier, update to version 0.9.3.1 to define the appropriate context for credentials lookup, preventing the use of System-scoped credentials otherwise reserved for the global configuration.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2023-03901

CVE-2023-32262

GHSA-PX39-5H8C-J3C8

Affected Products

Dimensions Plugin

References · 9

• https://portal.microfocus.com/s/article/KM000019298 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-px39-5h8c-j3c8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32262 · Security Note
• https://bdu.fstec.ru/vul/2023-03901 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32262 · Vendor Advisory
• https://jenkins.io/security/advisory/2023-06-14 · Note
• https://plugins.jenkins.io/dimensionsscm · Note
• https://jenkins.io/security/advisory/2023-06-14/#SECURITY-3143 · Note
• https://cybersecurity-help.cz/vdb/SB2023061633 · Note