En resumen
- CVE-2023-32262 es una vulnerabilidad MEDIO (CVSS 6.5) que afecta a org.jenkins-ci.plugins:dimensionsscm, dimensions cm (microfocus).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.83%, mayor que el 57.6% de las vulnerabilidades.
- Solución: actualizar a 0.9.3.1 o posterior.
Description
Dimensions Plugin 0.9.3 and earlier does not set the appropriate context for credentials lookup, allowing the use of System-scoped credentials otherwise reserved for the global configuration.
This allows attackers with Item/Configure permission to access and capture credentials they are not entitled to.
Dimensions Plugin 0.9.3.1 defines the appropriate context for credentials lookup.
NVD description
A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with Item/Configure permission to access and capture credentials they are not entitled to.
See the following Jenkins security advisory for details: * https://www.jenkins.io/security/advisory/2023-06-14/ https://www.jenkins.io/security/advisory/2023-06-14/
Más vulnerabilidades de org.jenkins-ci.plugins:dimensionsscm
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free