Information disclosure

2023-09-0613:15:00

PRIOn knowledge base

www.prio-n.com

information disclosure

aws codecommit

jenkins

credentials enumeration

4.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.4%

JSON

A missing permission check in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins.

CPENameOperatorVersion
aws_codecommit_triggerle3.0.12

CPE	Name	Operator	Version
	aws_codecommit_trigger	le	3.0.12

References

www.openwall.com/lists/oss-security/2023/09/06/9

www.jenkins.io/security/advisory/2023-09-06/