CVE-2023-2196: Missing permission checks in Code Dx Plugin
A missing permission check in Jenkins Code Dx Plugin 3.1.0 and earlier allows attackers with Item/Read permission to check for the existence of an attacker-specified file path on an agent file system.
Other sources
Jenkins Code Dx Plugin 3.1.0 and earlier does not perform a permission check in a method implementing form validation.
This allows attackers with Item/Read permission to check for the existence of an attacker-specified file path on an agent file system.
Code Dx Plugin 4.0.0 requires Item/Configure permission for this form validation method and ensures that only files located within the workspace can be checked.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-2196?
CVE-2023-2196 has a medium severity rating due to the missing permission check allowing unauthorized file path access.
How do I fix CVE-2023-2196?
To resolve CVE-2023-2196, upgrade the Jenkins Code Dx Plugin to version 4.0.0 or later.
What is the impact of CVE-2023-2196?
CVE-2023-2196 allows attackers with Item/Read permission to enumerate the file paths on an agent’s file system.
Which versions of Jenkins Code Dx Plugin are affected by CVE-2023-2196?
Jenkins Code Dx Plugin version 3.1.0 and earlier are affected by CVE-2023-2196.
Are there any workarounds for CVE-2023-2196?
There are no documented workarounds for CVE-2023-2196; updating to the latest version is recommended.