CVE-2023-24433: Missing permission checks in Jenkins Orka Plugin allow capturing credentials
Summary
CVE-2023-24433: Missing permission checks in Jenkins Orka Plugin allow capturing credentials. Affects io.jenkins.plugins:macstadium-orka versions < 1.32. Fixed in 1.32. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Jenkins Orka by MacStadium Plugin is a tool used in Jenkins, an open-source automation server, to manage virtual machines on the Orka platform. It provides functionality to connect to an attacker-specified HTTP server using attacker-specified credentials IDs. This plugin is vulnerable to a security issue that allows attackers with Overall/Read permission to capture credentials stored in Jenkins.
Vulnerability Detail
The vulnerability in Jenkins Orka Plugin arises from missing permission checks. Attackers with Overall/Read permission can exploit this flaw to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method. By doing so, they can capture credentials stored in Jenkins. This vulnerability has a CVSS score of 6.5, indicating a moderate severity level. The CWE ID associated with this vulnerability is CWE-862.
How To Fix
Latest published version: 2.10 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.32
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can restrict the Overall/Read permission to trusted individuals or groups. By limiting access to this permission, the risk of unauthorized credential capture can be mitigated.
Conclusion
The missing permission checks in Jenkins Orka Plugin allow attackers with Overall/Read permission to capture credentials stored in Jenkins. To mitigate this vulnerability, it is crucial to update the plugin to version 1.32 or later. Additionally, restricting access to the Overall/Read permission can provide an extra layer of security. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.jenkins.plugins:macstadium-orka →
FAQ
This vulnerability allows attackers with Overall/Read permission to capture credentials stored in Jenkins, potentially leading to unauthorized access to sensitive information or systems.
Users of Jenkins Orka Plugin versions 1.31 and earlier are affected by this vulnerability.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
Yes, updating the Jenkins Orka Plugin to version 1.32 or later will fix this vulnerability.
Yes, restricting the Overall/Read permission to trusted individuals or groups can mitigate the risk of unauthorized credential capture.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.jenkins.plugins:macstadium-orka.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
