CVE-2023-23848

CVSS v3.1 4.3 (Medium)

EPSS 0.05 % (23^th)

Affected Products 1

Advisories 2

Missing permission checks in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Weaknesses

CWE-276: Incorrect Default Permissions
CWE-862: Missing Authorization

CVE Status: PUBLISHED
CNA: Synopsys
Published Date: 2023-02-15 19:15:13
(19 months ago)
Updated Date: 2023-11-07 04:08:01
(10 months ago)

Affected Products

Jenkins

Synopsys Coverity

Configuration #1

		CPE23	From	Up To
	Jenkins Synopsys Coverity for Jenkins prior 3.0.3 version	cpe:2.3:a:jenkins:synopsys_coverity::::::jenkins		< 3.0.3