CVE-2023-41945

2023-09-0612:09:02

jenkins

www.cve.org

jenkins

assembla auth plugin

permissions

cve-2023-41945

8.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.3%

JSON

Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT permissions to be granted Overall/Manage and Overall/SystemRead permissions, even if those permissions are disabled and should not be granted.

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "Jenkins Assembla Auth Plugin",
    "vendor": "Jenkins Project",
    "versions": [
      {
        "lessThanOrEqual": "1.14",
        "status": "affected",
        "version": "0",
        "versionType": "maven"
      }
    ]
  }
]