Access Restriction Bypass Affecting org.jenkins-ci.plugins:ghprb package, versions [0,]
Threat Intelligence
EPSS
0.05% (24th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGJENKINSCIPLUGINS-3248510
- published 26 Jan 2023
- disclosed 26 Jan 2023
- credit Valdes Che Zogou, CloudBees, Inc.
Introduced: 26 Jan 2023
CVE-2023-24436 Open this link in a new tabHow to fix?
There is no fixed version for org.jenkins-ci.plugins:ghprb.
Overview
org.jenkins-ci.plugins:ghprb is a github pull requests builder plugin for Jenkins
Affected versions of this package are vulnerable to Access Restriction Bypass. It does not perform a permission check in an HTTP endpoint.This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.As of publication of this advisory, there is no fix.
References
CVSS Scores
version 3.1