CVE-2023-24453: Missing permission check in Jenkins TestQuality Updater Plugin
Summary
CVE-2023-24453: Missing permission check in Jenkins TestQuality Updater Plugin. Affects org.jenkins-ci.plugins:testquality-updater versions < 1.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins TestQuality Updater Plugin is a Maven package that allows users to update test quality metrics in Jenkins. It provides functionality to connect to external systems and update test results. The plugin is widely used in Jenkins environments for managing and tracking test quality.
Vulnerability Detail
A missing permission check in Jenkins TestQuality Updater Plugin version 1.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password. This vulnerability can be exploited by an authenticated attacker to perform unauthorized actions, potentially compromising the integrity and confidentiality of the system. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by upgrading to the latest version of the Jenkins TestQuality Updater Plugin.
Conclusion
The Jenkins TestQuality Updater Plugin version 1.3 and earlier is vulnerable to a missing permission check, allowing attackers with Overall/Read permission to connect to an attacker-specified URL. To mitigate this vulnerability, users should upgrade to version 1.4 of the plugin. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:testquality-updater →
FAQ
This vulnerability allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password. It can lead to unauthorized access and potential compromise of the system's integrity and confidentiality.
Users of Jenkins TestQuality Updater Plugin versions 1.3 and earlier are affected by this vulnerability.
Yes, an authenticated user with Overall/Read permission is required to exploit this vulnerability.
Yes, the vulnerability has been patched in version 1.4 of the Jenkins TestQuality Updater Plugin.
No, there are no known workarounds for this vulnerability. It is crucial to upgrade to the fixed version of the plugin.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:testquality-updater.
