GHSA-66hv-fhcm-7xm7

Suggest an improvement
Source
https://github.com/advisories/GHSA-66hv-fhcm-7xm7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-66hv-fhcm-7xm7/GHSA-66hv-fhcm-7xm7.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-66hv-fhcm-7xm7
Aliases
  • CVE-2023-46651
Published
2023-10-25T18:32:25Z
Modified
2024-02-16T08:19:40.175294Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Jenkins Warnings Plugin exposures system-scoped credentials
Details

Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing the use of system-scoped credentials otherwise reserved for the global configuration.

This allows attackers with Item/Configure permission to access and capture credentials they are not entitled to.

Warnings Plugin 10.5.1 defines the appropriate context for credentials lookup. This fix has been backported to 10.4.1.

Database specific 
{
    "nvd_published_at": "2023-10-25T18:17:39Z",
    "cwe_ids": [
        "CWE-200",
        "CWE-522"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-30T15:18:27Z"
}
References

Affected packages

Maven / io.jenkins.plugins:warnings-ng

Package

Name
io.jenkins.plugins:warnings-ng
View open source insights on deps.dev
Purl
pkg:maven/io.jenkins.plugins/warnings-ng

Affected ranges

Type
ECOSYSTEM
Events
Introduced
10.5.0
Fixed
10.5.1

Affected versions

10.*

10.5.0

Maven / io.jenkins.plugins:warnings-ng

Package

Name
io.jenkins.plugins:warnings-ng
View open source insights on deps.dev
Purl
pkg:maven/io.jenkins.plugins/warnings-ng

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
10.4.1

Affected versions

1.*

1.0.0-beta1
1.0.0-beta2
1.0.0-beta3
1.0.0-beta4
1.0.0-beta5
1.0.0-beta6
1.0.0-beta7
1.0.0-beta8
1.0.0-beta9
1.0.0-beta10
1.0.0
1.0.1

2.*

2.0.0
2.1.0
2.1.1
2.1.2
2.2.0
2.2.1

3.*

3.0.0
3.0.1
3.0.3

4.*

4.0.0

5.*

5.0.0
5.1.0
5.2.0
5.2.1
5.3.0

6.*

6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.1.0
6.1.1

7.*

7.0.0
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.2.2
7.3.0

8.*

8.0.0-beta1
8.0.0-beta2
8.0.0-beta3
8.0.0-beta5
8.0.0-beta6
8.0.0-beta7
8.0.0-beta8
8.0.0
8.1.0
8.2.0
8.3.0
8.4.0
8.4.1
8.4.1.1
8.4.2
8.4.3
8.4.3.1
8.4.4
8.5.0
8.6.0
8.6.1
8.6.2
8.6.3
8.7.0
8.8.0
8.8.0.1
8.9.0
8.9.1
8.9.2
8.10.0
8.10.1

9.*

9.0.0
9.0.1
9.0.2
9.1.0
9.2.0
9.2.1
9.3.0
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.7.1
9.8.0
9.9.0
9.10.0
9.10.1
9.10.2
9.10.3
9.11.0
9.11.1
9.12.0
9.13.0
9.14.0
9.15.0
9.16.0
9.17.0
9.18.0
9.19.0
9.19.1
9.19.2
9.20.0
9.20.1
9.21.0
9.22.0
9.23.0
9.23.1

10.*

10.0.1
10.0.2
10.0.3
10.1.0
10.2.0
10.3.0
10.4.0