PT-2023-6484 · Jenkins · Jenkins Warnings Plugin+1

Andrea Chiera · Published 2023-10-25 · Updated 2023-11-01 · CVE-2023-46651

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Warnings Plugin versions 10.5.0 and earlier

Description The issue is related to information disclosure, allowing remote attackers to gain unauthorized access to protected information. Specifically, it does not set the appropriate context for credentials lookup, enabling attackers with Item/Configure permission to access and capture credentials they are not entitled to. This allows the use of system-scoped credentials otherwise reserved for the global configuration.

Recommendations For Jenkins Warnings Plugin versions 10.5.0 and earlier, update to version 10.5.1 or later, or apply the backported fix to version 10.4.1, to define the appropriate context for credentials lookup and prevent unauthorized access to credentials. As a temporary workaround, consider restricting access to the credentials lookup functionality for users with Item/Configure permission until the update is applied.

Fix

Insufficiently Protected Credentials

Information Disclosure

Weakness Enumeration

CWE-522

CWE-200

Related Identifiers

BDU:2023-07224

CVE-2023-46651

GHSA-66HV-FHCM-7XM7

Affected Products

Jenkins

Jenkins Warnings Plugin

References · 14

• https://jenkins.io/security/advisory/2023-10-25/#SECURITY-3265 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-46651 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46651 · Security Note
• https://osv.dev/vulnerability/GHSA-66hv-fhcm-7xm7 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07224 · Security Note
• https://github.com/jenkinsci/warnings-ng-plugin · Note
• https://github.com/jenkinsci/warnings-ng-plugin/commit/17d18d2fae58f5658a40d03a03f927819eb6cf1a · Note
• https://github.com/jenkinsci/warnings-ng-plugin/commit/372cd40ce73b25d8ae632b262f6ae1cd36ad9e4c · Note
• https://t.me/latest_high_impact_cve/65 · Telegram Post
• https://vuldb.com/?id.243421 · Note
• https://t.me/cvenotify/60308 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2023102609 · Note
• https://twitter.com/fletch_ai/status/1719536495290171507 · Twitter Post
• http://openwall.com/lists/oss-security/2023/10/25/2 · Note