Unauthorized Credential Enumeration in Jenkins GitHub Pull Request Builder Plugin
CVE-2023-24436
4.3MEDIUM
Key Information:
- Vendor
Jenkins
- Vendor
- CVE Published:
- 26 January 2023
What is CVE-2023-24436?
The Jenkins GitHub Pull Request Builder Plugin suffers from a security flaw that allows users with Overall/Read permissions to access and enumerate the IDs of stored credentials in Jenkins. This missing permission verification creates an avenue for attackers to exploit sensitive information, posing a significant risk to user security and data integrity. Keeping the plugin updated and reviewing user permissions are crucial steps to mitigate this vulnerability.
Affected Version(s)
Jenkins GitHub Pull Request Builder Plugin <= 1.42.2