GHSA-436g-2f92-cvhh

Source

https://github.com/advisories/GHSA-436g-2f92-cvhh

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-436g-2f92-cvhh/GHSA-436g-2f92-cvhh.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-436g-2f92-cvhh

Aliases

CVE-2023-28668

Published

2023-04-02T21:30:17Z

Modified

2024-12-06T05:31:22.350808Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N CVSS Calculator

Summary

Jenkins Role-based Authorization Strategy Plugin grants permissions even after they’ve been disabled

Details

Permissions in Jenkins can be enabled and disabled. Some permissions are disabled by default, e.g., Overall/Manage or Item/Extended Read. Disabled permissions cannot be granted directly, only through greater permissions that imply them (e.g., Overall/Administer or Item/Configure).

Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they’ve been disabled.

This allows attackers to have greater access than they’re entitled to after the following operations took place:

A permission is granted to attackers directly or through groups.

The permission is disabled, e.g., through the script console.

Role-based Authorization Strategy Plugin 587.588.v850a20a30162 does not grant disabled permissions.

Database specific

{
    "nvd_published_at": "2023-04-02T21:15:00Z",
    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-03T22:55:17Z"
}

References

Affected packages

Maven / org.jenkins-ci.plugins:role-strategy

Package

Name: org.jenkins-ci.plugins:role-strategy; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/role-strategy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

587.588.v850a_20a_30162

Affected versions

1.*

1.1.2

1.1.3

2.*

2.1.0

2.2.0

2.3.0

2.3.1

2.3.2

2.4.0

2.5.0

2.5.1

2.6.0

2.6.1

2.7.0

2.8.0

2.8.1

2.8.2

2.9.0

2.10

2.11

2.12

2.13

2.14

2.15

2.16

3.*

3.0

3.1

3.1.1

3.2.0

483.*

483.v17281966f5c3

484.*

484.v8a_a_e4b_d785fd

488.*

488.v0634ce149b_8c

501.*

501.v88fe53d65c80

506.*

506.v13f908ee1fc9

508.*

508.v2a_f05b_05e9d8

510.*

510.v909834359ec2

521.*

521.vcf7a_3a_8dde42

526.*

526.v859673312a_14

530.*

530.ved5445d4875a_

546.*

546.ve16648865996

548.*

548.vb_60076577ec7

552.*

552.v14cb_85499b_89

555.*

555.v8d194cc85b_30

561.*

561.v9846c7351a_41

562.*

562.v44e9a_e828d0e

569.*

569.v7476f8e4fe29

575.*

575.v4d286a_03e6d7

584.*

584.vf8e515397ecd

587.*

587.v2872c41fa_e51

Database specific

{
    "last_known_affected_version_range": "< 587.588.v850a"
}