CVE-2023-50768: CSRF
A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Other sources
Jenkins Nexus Platform Plugin 3.18.0-03 and earlier does not perform permission checks in methods implementing form validation.
This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Nexus Platform Plugin 3.18.1-01 requires POST requests and Overall/Administer permission for the affected form validation methods.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-50768?
CVE-2023-50768 is categorized as a cross-site request forgery (CSRF) vulnerability that can lead to credential theft.
How do I fix CVE-2023-50768?
To mitigate CVE-2023-50768, upgrade the Jenkins Nexus Platform Plugin to version 3.18.1-01 or later.
What software is affected by CVE-2023-50768?
CVE-2023-50768 affects Jenkins Nexus Platform Plugin versions 3.18.0-03 and earlier.
What can attackers do exploiting CVE-2023-50768?
Attackers exploiting CVE-2023-50768 can connect to an attacker-specified HTTP server and potentially capture Jenkins-stored credentials.
Is there a recommended version to prevent CVE-2023-50768?
Yes, the recommended version to prevent CVE-2023-50768 is Jenkins Nexus Platform Plugin version 3.18.1-01 or later.