Jenkins Fortify Plugin missing permission check

中 4.3CVE-2023-4302 · GHSA-4xmf-344q-m4cc · 21/08/2023 公開 · 17/06/2026 更新

要点

CVE-2023-4302 は org.jenkins-ci.plugins:fortify, fortify (jenkins) に影響する深刻度「中」 (CVSS 4.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.32%（全脆弱性の 24.8% より高い）。
対処：22.2.39 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.jenkins-ci.plugins:fortify Maven	`< 22.2.39`	`22.2.39`
fortify jenkins	`< 22.2.39`	`22.2.39`

概要

Jenkins Fortify Plugin 22.1.38 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Fortify Plugin 22.2.39 requires POST requests and the appropriate permissions for the affected HTTP endpoints.

NVD の説明

A missing permission check in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.