CVE-2023-32261: Dimensions CM Plugin for Jenkins 0.8.17 – 0.9.3
A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. See the following Jenkins security advisory for details: https://www.jenkins.io/security/advisory/2023-06-14/ https://www.jenkins.io/security/advisory/2023-06-14/
Other sources
Dimensions Plugin 0.9.3 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.
An enumeration of credentials IDs in Dimensions Plugin 0.9.3.1 requires the appropriate permissions.
— GitHub
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2023-32261?
CVE-2023-32261 is a potential vulnerability in the Micro Focus Dimensions CM Plugin for Jenkins that allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
How does CVE-2023-32261 affect Micro Focus Dimensions CM Plugin for Jenkins?
CVE-2023-32261 affects Micro Focus Dimensions CM Plugin for Jenkins by allowing attackers to discover the IDs of credentials stored in Jenkins.
What is the severity of CVE-2023-32261?
The severity of CVE-2023-32261 is medium, with a CVSS score of 6.5.
How can I fix CVE-2023-32261?
To fix CVE-2023-32261, it is recommended to update the Micro Focus Dimensions CM Plugin for Jenkins to a version higher than 0.9.3.1.
Where can I find more information about CVE-2023-32261?
More information about CVE-2023-32261 can be found in the Jenkins security advisory and the Micro Focus Dimensions CM Plugin for Jenkins documentation.