En bref
- CVE-2023-32262 est une vulnérabilité MOYENNE (CVSS 6.5) touchant org.jenkins-ci.plugins:dimensionsscm, dimensions cm (microfocus).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.83%, plus élevée que 57.6% des vulnérabilités.
- Correctif : mettre à jour vers 0.9.3.1 ou plus récent.
Description
Dimensions Plugin 0.9.3 and earlier does not set the appropriate context for credentials lookup, allowing the use of System-scoped credentials otherwise reserved for the global configuration.
This allows attackers with Item/Configure permission to access and capture credentials they are not entitled to.
Dimensions Plugin 0.9.3.1 defines the appropriate context for credentials lookup.
NVD description
A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with Item/Configure permission to access and capture credentials they are not entitled to.
See the following Jenkins security advisory for details: * https://www.jenkins.io/security/advisory/2023-06-14/ https://www.jenkins.io/security/advisory/2023-06-14/
Autres vulnérabilités de org.jenkins-ci.plugins:dimensionsscm
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free