CVE-2023-25768: Missing Authorization in Jenkins Azure Credentials Plugin
Summary
CVE-2023-25768: Missing Authorization in Jenkins Azure Credentials Plugin. Affects org.jenkins-ci.plugins:azure-credentials versions < 254.v64da_8176c83a. Fixed in 254.v64da_8176c83a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Azure Credentials Plugin is a Maven package (org.jenkins-ci.plugins:azure-credentials) that provides functionality for managing Azure credentials within Jenkins. It allows users to securely store and use Azure credentials for various tasks in their Jenkins pipelines. The plugin is widely used by organizations leveraging Azure services in their CI/CD workflows.
Vulnerability Detail
The Jenkins Azure Credentials Plugin version 253.v887e0f9e898b and earlier is affected by a missing authorization vulnerability. This vulnerability allows attackers with Overall/Read permission to connect to an attacker-specified web server. By exploiting this vulnerability, an attacker can potentially gain unauthorized access to sensitive information or perform malicious actions on the Jenkins server.
How To Fix
Minimum fixed version
254.v64da_8176c83a
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict the Overall/Read permission to trusted individuals or groups only. This can be done by modifying the Jenkins server's access control settings. However, this workaround may limit the functionality of the plugin for legitimate users, and it is strongly advised to apply the official patch or upgrade to a fixed version.
Conclusion
The Jenkins Azure Credentials Plugin is affected by a missing authorization vulnerability that allows attackers with Overall/Read permission to connect to an attacker-specified web server. To mitigate the risk, it is recommended to upgrade the plugin to a fixed version or apply the official patch. Restricting the Overall/Read permission can serve as a temporary workaround, but it may limit the functionality of the plugin. For further assistance and guidance on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:azure-credentials →
FAQ
This vulnerability allows attackers with Overall/Read permission to connect to an attacker-specified web server. Depending on the attacker's intentions, this can lead to unauthorized access to sensitive information, data manipulation, or disruption of Jenkins pipelines.
No, only versions up to and including 253.v887e0f9e898b are affected by this vulnerability. It is recommended to check the version of the plugin installed in your Jenkins instance and upgrade if necessary.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is crucial to apply the necessary fixes or workarounds to mitigate the risk of potential exploitation.
Yes, this vulnerability can be exploited remotely by attackers with Overall/Read permission. They can connect to an attacker-specified web server and potentially perform unauthorized actions on the Jenkins server.
Yes, the CVSS score for this vulnerability is 6.5 (Medium severity). The score indicates a moderate level of risk associated with the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:azure-credentials.
