Missing Permission Check in Jenkins GitHub Pull Request Builder Plugin
CVE-2023-24435
6.5MEDIUM
Key Information:
- Vendor
Jenkins
- Vendor
- CVE Published:
- 26 January 2023
What is CVE-2023-24435?
A missing permission check in Jenkins' GitHub Pull Request Builder Plugin allows users with Overall/Read permissions to connect to unauthorized URLs. This vulnerability can be exploited by attackers to gain access to compromised credentials by using credential IDs that they obtain through various means, exposing sensitive data stored within Jenkins.
Affected Version(s)
Jenkins GitHub Pull Request Builder Plugin <= 1.42.2