Jenkins Datadog Plugin does not perform a permission check in an HTTP endpoint.

MOYENNE 6.5CVE-2023-37944 · GHSA-w3p4-7823-m33q · Published 12/07/2023 · updated 17/06/2026

En bref

CVE-2023-37944 est une vulnérabilité MOYENNE (CVSS 6.5) touchant org.datadog.jenkins.plugins:datadog, datadog (jenkins).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.83%, plus élevée que 57.7% des vulnérabilités.
Correctif : mettre à jour vers 5.4.2 ou plus récent.

Package	Affected versions	Patched versions
org.datadog.jenkins.plugins:datadog Maven	`< 5.4.2`	`5.4.2`
datadog jenkins	`< 5.4.2`	`5.4.2`

Description

Jenkins Datadog Plugin 5.4.1 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Datadog Plugin 5.4.2 requires Overall/Administer permission to access the affected HTTP endpoint.

NVD description

A missing permission check in Jenkins Datadog Plugin 5.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

References

nvd.nist.gov/vuln/detail/CVE-2023-37944 · ADVISORY
jenkins.io/security/advisory/2023-07-12 · WEB
openwall.com/lists/oss-security/2023/07/12/2 · WEB

Autres vulnérabilités de org.datadog.jenkins.plugins:datadog

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.datadog.jenkins.plugins:datadog

Maven

< 5.4.2

5.4.2

datadog

jenkins

< 5.4.2

5.4.2

Description

Jenkins Datadog Plugin 5.4.1 and earlier does not perform a permission check in an HTTP endpoint.

Datadog Plugin 5.4.2 requires Overall/Administer permission to access the affected HTTP endpoint.

NVD description