GHSA-wwww-xvm2-62w7
Jenkins Delphix Plugin vulnerable to exposure of system-scoped credentials
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins:delphix | < 3.0.3 | 3.0.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
Jenkins Delphix Plugin 3.0.2 and earlier does not set the appropriate context for credentials lookup, allowing the use of System-scoped credentials otherwise reserved for the global configuration.
This allows attackers with Overall/Read permission to access and capture credentials they are not entitled to.
Delphix Plugin 3.0.3 defines the appropriate context for credentials lookup.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2023-40345
- https://support.delphix.com/Support_Policies_and_Technical_Bulletins/Technical_Bulletins/TB111_Delphix_Plugin_for_Jenkins_Vulnerable_to_Cred…
- https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3214%20(2)
- http://www.openwall.com/lists/oss-security/2023/08/16/3