Jenkins Datadog Plugin does not perform a permission check in an HTTP endpoint.

MITTEL 6.5CVE-2023-37944 · GHSA-w3p4-7823-m33q · Published 12/07/2023 · updated 17/06/2026

Kurz gesagt

CVE-2023-37944 ist eine Schwachstelle (MITTEL (CVSS 6.5)) in org.datadog.jenkins.plugins:datadog, datadog (jenkins).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.83%, höher als bei 57.7% aller Schwachstellen.
Abhilfe: auf 5.4.2 oder neuer aktualisieren.

Package	Affected versions	Patched versions
org.datadog.jenkins.plugins:datadog Maven	`< 5.4.2`	`5.4.2`
datadog jenkins	`< 5.4.2`	`5.4.2`

Description

Jenkins Datadog Plugin 5.4.1 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Datadog Plugin 5.4.2 requires Overall/Administer permission to access the affected HTTP endpoint.

NVD description

A missing permission check in Jenkins Datadog Plugin 5.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

References

nvd.nist.gov/vuln/detail/CVE-2023-37944 · ADVISORY
jenkins.io/security/advisory/2023-07-12 · WEB
openwall.com/lists/oss-security/2023/07/12/2 · WEB

Weitere Schwachstellen in org.datadog.jenkins.plugins:datadog

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.datadog.jenkins.plugins:datadog

Maven

< 5.4.2

5.4.2

datadog

jenkins

< 5.4.2

5.4.2

Description

Jenkins Datadog Plugin 5.4.1 and earlier does not perform a permission check in an HTTP endpoint.

Datadog Plugin 5.4.2 requires Overall/Administer permission to access the affected HTTP endpoint.

NVD description