CVE-2023-24438: Medium severity jenkins vulnerability
A missing permission check in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-24438?
CVE-2023-24438 has been rated as a high severity vulnerability due to its potential for unauthorized access to sensitive credentials.
How do I fix CVE-2023-24438?
To remediate CVE-2023-24438, upgrade the Jenkins JIRA Pipeline Steps Plugin to version 2.0.166 or later.
Who is affected by CVE-2023-24438?
Users of Jenkins JIRA Pipeline Steps Plugin versions 2.0.165.v8846cf59f3db and earlier are affected by CVE-2023-24438.
What does CVE-2023-24438 exploit?
CVE-2023-24438 exploits a missing permission check that allows attackers to connect to arbitrary URLs using stolen credentials.
What is the impact of CVE-2023-24438?
The impact of CVE-2023-24438 includes potential credential theft and unauthorized access to connected systems.