CVE-2023-24435: Medium severity jenkins github pull request builder vulnerability
A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-24435?
CVE-2023-24435 is considered a critical vulnerability due to its potential to expose sensitive credentials.
How do I fix CVE-2023-24435?
To fix CVE-2023-24435, upgrade the Jenkins GitHub Pull Request Builder Plugin to version 1.42.3 or later, which addresses the missing permission check.
Who is affected by CVE-2023-24435?
CVE-2023-24435 affects Jenkins GitHub Pull Request Builder Plugin versions 1.42.2 and earlier.
What are the risks associated with CVE-2023-24435?
The risks associated with CVE-2023-24435 include unauthorized access to Jenkins credentials, which can lead to further exploitation of the Jenkins environment.
Can CVE-2023-24435 be exploited remotely?
Yes, CVE-2023-24435 can be exploited remotely by attackers who have Overall/Read permission within the Jenkins system.