CVE-2023-25766 - A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows

CVE-2023-25766

Summary

A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

References

https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-1757
http://www.openwall.com/lists/oss-security/2023/02/15/4

Vulnerable Configurations

cpe:2.3:a:jenkins:azure_credentials:-:*:*:*:*:jenkins:*:*
cpe:2.3:a:jenkins:azure_credentials:-:*:*:*:*:jenkins:*:*

CVSS

Base:	None
Impact:
Exploitability:

CWE

CWE-862

CAPEC

Access

Vector	Complexity	Authentication

Impact

Confidentiality	Integrity	Availability

Last major update

03-11-2023 - 02:06

Published

15-02-2023 - 14:15

Last modified

03-11-2023 - 02:06