~ / search / GHSA-qmhq-876f-cr65

GHSA-qmhq-876f-cr65

Jenkins Jira Plugin vulnerable to exposure of system-scoped credentials

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-49653

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:jira < 3.12 3.12

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Jira Plugin 3.11 and earlier does not set the appropriate context for credentials lookup, allowing the use of system-scoped credentials otherwise reserved for the global configuration. This allows attackers with Item/Configure permission to access and capture credentials they are not entitled to. Jira Plugin 3.12 defines the appropriate context for credentials lookup.

References

External links from the advisory. They lead to third-party sites.