Missing Permission Check in Jenkins Frugal Testing Plugin Affects Security
CVE-2023-41947

4.3MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Frugal Testing Plugin
Vendor
CVE Published:
6 September 2023

Summary

A vulnerability has been identified in the Jenkins Frugal Testing Plugin that permits attackers with Overall/Read permissions to connect to Frugal Testing using credentials they specify. This oversight in the permission check may lead to unauthorized access, potentially compromising sensitive information and functionality within Jenkins environments.

Affected Version(s)

Jenkins Frugal Testing Plugin 0 <= 1.1

References

https://www.jenkins.io/security/advisory/2023-09-06/#SECU...
vendor-advisory
http://www.openwall.com/lists/oss-security/2023/09/06/9

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.