CVE-2023-32988: CSRF
A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a43 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Other sources
Jenkins Azure VM Agents Plugin 852.v8d35f0960a43 and earlier does not perform permission checks in several HTTP endpoints.
This allows attackers with Overall/Read permission to connect to an attacker-specified Azure Cloud server using attacker-specified credentials IDs obtained through another method.
Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Azure VM Agents Plugin 853.v4a1add947520 requires POST requests and the appropriate permissions for the affected HTTP endpoints.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-32988?
CVE-2023-32988 is considered a high severity vulnerability due to its potential for credential enumeration.
What versions are affected by CVE-2023-32988?
CVE-2023-32988 affects Jenkins Azure VM Agents Plugin versions up to and including 852.v8d35f0960a_43.
How do I fix CVE-2023-32988?
To mitigate CVE-2023-32988, upgrade the Jenkins Azure VM Agents Plugin to version 853.v4a or later.
What does CVE-2023-32988 allow attackers to do?
CVE-2023-32988 allows attackers with Overall/Read permission to enumerate credentials IDs stored in Jenkins.
Is there a workaround for CVE-2023-32988?
There is no documented workaround for CVE-2023-32988; upgrading is the recommended solution.