Jenkins Nexus Platform Plugin missing permission check

中 4.3CVE-2023-50769 · GHSA-4g5f-w3mh-w99m · 13/12/2023 公開 · 17/06/2026 更新

要点

CVE-2023-50769 は org.sonatype.nexus.ci:nexus-jenkins-plugin, nexus platform (jenkins) に影響する深刻度「中」 (CVSS 4.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.48%（全脆弱性の 41.8% より高い）。
対処：3.18.1-01 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.sonatype.nexus.ci:nexus-jenkins-plugin Maven	`< 3.18.1-01`	`3.18.1-01`
nexus platform jenkins	`≤ 3.18.0-03`	修正版なし

概要

Jenkins Nexus Platform Plugin 3.18.0-03 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Nexus Platform Plugin 3.18.1-01 requires POST requests and Overall/Administer permission for the affected form validation methods.

NVD の説明

Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.