Kurz gesagt
- CVE-2023-32262 ist eine Schwachstelle (MITTEL (CVSS 6.5)) in org.jenkins-ci.plugins:dimensionsscm, dimensions cm (microfocus).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.83%, höher als bei 57.6% aller Schwachstellen.
- Abhilfe: auf 0.9.3.1 oder neuer aktualisieren.
Description
Dimensions Plugin 0.9.3 and earlier does not set the appropriate context for credentials lookup, allowing the use of System-scoped credentials otherwise reserved for the global configuration.
This allows attackers with Item/Configure permission to access and capture credentials they are not entitled to.
Dimensions Plugin 0.9.3.1 defines the appropriate context for credentials lookup.
NVD description
A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with Item/Configure permission to access and capture credentials they are not entitled to.
See the following Jenkins security advisory for details: * https://www.jenkins.io/security/advisory/2023-06-14/ https://www.jenkins.io/security/advisory/2023-06-14/
Weitere Schwachstellen in org.jenkins-ci.plugins:dimensionsscm
Alle anzeigen →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free