medium4.3
CVE-2023-32262
Exposure of system-scoped credentials in Jenkins Dimensions Plugin
Impact
Dimensions Plugin 0.9.3 and earlier does not set the appropriate context for credentials lookup, allowing the use of System-scoped credentials otherwise reserved for the global configuration. This allows attackers with Item/Configure permission to access and capture credentials they are not entitled to. Dimensions Plugin 0.9.3.1 defines the appropriate context for credentials lookup.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:dimensionsscm | <= 0.9.3 | 0.9.3.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microfocus | Dimensions Cm | from 0.8.17 before 0.9.3.1 |
References
- NVD record
- CVE.org record
- GitHub advisory
- https://plugins.jenkins.io/dimensionsscm/
- https://portal.microfocus.com/s/article/KM000019298
- https://www.jenkins.io/security/advisory/2023-06-14/
- https://github.com/advisories/GHSA-px39-5h8c-j3c8
- https://nvd.nist.gov/vuln/detail/CVE-2023-32262
- https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-3143