Access Control Bypass Affecting org.jenkins-ci.plugins:macstadium-orka package, versions [,1.32)
Threat Intelligence
EPSS
0.05% (24th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGJENKINSCIPLUGINS-3248524
- published 26 Jan 2023
- disclosed 26 Jan 2023
- credit Valdes Che Zogou, CloudBees, Inc.
Introduced: 26 Jan 2023
CVE-2023-24431 Open this link in a new tabHow to fix?
Upgrade org.jenkins-ci.plugins:macstadium-orka to version 1.32 or higher.
Overview
Affected versions of this package are vulnerable to Access Control Bypass. It does not perform permission checks in several HTTP endpoints.This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.
References
CVSS Scores
version 3.1