CVE-2023-32262: Dimensions CM Plugin for Jenkins 0.8.17 – 0.9.3
A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with Item/Configure permission to access and capture credentials they are not entitled to. See the following Jenkins security advisory for details: https://www.jenkins.io/security/advisory/2023-06-14/ https://www.jenkins.io/security/advisory/2023-06-14/
Other sources
Dimensions Plugin 0.9.3 and earlier does not set the appropriate context for credentials lookup, allowing the use of System-scoped credentials otherwise reserved for the global configuration.
This allows attackers with Item/Configure permission to access and capture credentials they are not entitled to.
Dimensions Plugin 0.9.3.1 defines the appropriate context for credentials lookup.
— GitHub
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-32262.
What is the severity of CVE-2023-32262?
The severity of CVE-2023-32262 is medium.
Which software is affected by CVE-2023-32262?
Micro Focus Dimensions CM Plugin for Jenkins versions 0.8.17 to 0.9.3.1 are affected.
What actions can an attacker with Item/Configure permission perform?
An attacker with Item/Configure permission can access and capture credentials they are not entitled to.
Where can I find more information about CVE-2023-32262?
More information about CVE-2023-32262 can be found in the Jenkins security advisory and Micro Focus Dimensions CM Plugin documentation.