~ / search / GHSA-97mg-9jhf-r7rm

GHSA-97mg-9jhf-r7rm

Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin vulnerable to exposure of system-scoped credentials

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-40347

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:maven-artifact-choicelistprovider <= 1.14 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.14 and earlier does not set the appropriate context for credentials lookup, allowing the use of System-scoped credentials otherwise reserved for the global configuration. This allows attackers with Item/Configure permission to access and capture credentials they are not entitled to. As of publication of this advisory, there is no fix.

References

External links from the advisory. They lead to third-party sites.