CVE-2023-40345: Jenkins Delphix Plugin System-Scoped Credentials Exposure
Summary
CVE-2023-40345: Jenkins Delphix Plugin vulnerable to exposure of system-scoped credentials. Affects org.jenkins-ci.plugins:delphix versions < 3.0.3. Fixed in 3.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Delphix Plugin is a Maven package that provides integration between Jenkins and Delphix, a data virtualization platform. It allows users to automate data operations and manage data environments within their Jenkins pipelines. The plugin is widely used in software development and CI/CD workflows.
Vulnerability Detail
The Jenkins Delphix Plugin version 3.0.2 and earlier suffer from a vulnerability that allows exposure of system-scoped credentials. The plugin fails to set the appropriate context for credentials lookup, enabling the use of System-scoped credentials that are typically reserved for the global configuration. This flaw allows attackers with Overall/Read permission to access and capture credentials they are not authorized to view. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
3.0.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version as soon as possible.
Conclusion
The Jenkins Delphix Plugin version 3.0.2 and earlier are vulnerable to exposure of system-scoped credentials. Users should upgrade to version 3.0.3 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:delphix →
FAQ
The vulnerability allows attackers with Overall/Read permission to access and capture system-scoped credentials, potentially compromising sensitive information and credentials.
Users of Jenkins Delphix Plugin versions 3.0.2 and earlier are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this advisory.
Yes, users should upgrade to Delphix Plugin version 3.0.3 or later to fix this vulnerability.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:delphix.
