Description
Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to. This fix has been backported to 10.4.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins Project | Jenkins Warnings Plugin | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.jenkins.plugins:warnings-ng | >= 10.5.0, < 10.5.1 | 10.5.1 | GHSA-66hv-fhcm-7xm7 |
| Maven | io.jenkins.plugins:warnings-ng | < 10.4.1 | 10.4.1 | GHSA-66hv-fhcm-7xm7 |
Advisories 1
- WID-SEC-2023-2750 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 25, 2023