CVE-2023-25766

2023-02-1514:15:13

CWE-862

jenkins

web.nvd.nist.gov

cve-2023-25766

jenkins

azure

credentials plugin

nvd

security flaw

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.4

Confidence

High

EPSS

0.001

Percentile

22.8%

JSON

A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

Affected configurations

Nvd

Node

jenkinsazure_credentialsRange<254.v64da_8176c83ajenkins

VendorProductVersionCPE
jenkinsazure_credentials*cpe:2.3:a:jenkins:azure_credentials:*:*:*:*:*:jenkins:*:*

Vendor	Product	Version	CPE
jenkins	azure_credentials	*	cpe:2.3:a:jenkins:azure_credentials::::::jenkins::*

CNA Affected

[
  {
    "product": "Jenkins Azure Credentials Plugin",
    "vendor": "Jenkins Project",
    "versions": [
      {
        "lessThanOrEqual": "253.v887e0f9e898b",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]