CVE-2023-46651

2023-10-2518:17:39

Alpine Linux Development Team

security.alpinelinux.org

jenkins

warnings plugin

credentials

unauthorized access

backport

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

21.4%

JSON

Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to. This fix has been backported to 10.4.1.

OSVersionArchitecturePackageVersionFilename
Alpine3.18-communitynoarchjenkins= 2.387.3-r0UNKNOWN
Alpine3.19-communitynoarchjenkins= 2.440.3-r0UNKNOWN
Alpine3.20-communitynoarchjenkins= 2.440.2-r0UNKNOWN
Alpineedge-communitynoarchjenkins= 2.462.1-r0UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Alpine	3.18-community	noarch	jenkins	= 2.387.3-r0	UNKNOWN
Alpine	3.19-community	noarch	jenkins	= 2.440.3-r0	UNKNOWN
Alpine	3.20-community	noarch	jenkins	= 2.440.2-r0	UNKNOWN
Alpine	edge-community	noarch	jenkins	= 2.462.1-r0	UNKNOWN