CVE-2023-46651: Infoleak
Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to. This fix has been backported to 10.4.1.
Other sources
Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing the use of system-scoped credentials otherwise reserved for the global configuration.
This allows attackers with Item/Configure permission to access and capture credentials they are not entitled to.
Warnings Plugin 10.5.1 defines the appropriate context for credentials lookup. This fix has been backported to 10.4.1.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-46651?
CVE-2023-46651 is a vulnerability in the Jenkins Warnings Plugin that allows attackers with Item/Configure permission to access and capture credentials they are not supposed to.
What is the severity of CVE-2023-46651?
CVE-2023-46651 has a severity rating of 6.5, which is medium.
How can I check if my Jenkins Warnings Plugin is affected by CVE-2023-46651?
You can check if your Jenkins Warnings Plugin is affected by CVE-2023-46651 by checking the version number of the plugin. If it is version 10.5.0 or earlier, it is affected.
How do I fix CVE-2023-46651?
To fix CVE-2023-46651, you need to update your Jenkins Warnings Plugin to version 10.5.1 or later.
Where can I find more information about CVE-2023-46651?
You can find more information about CVE-2023-46651 on the Openwall, Jenkins, and NVD websites using the provided references.