CVE-2023-41941

The CVE-2023-41941 issue affects Jenkins and specifically the AWS CodeCommit Trigger Plugin 3.0.12 and earlier, where a missing permission check allows attackers with Overall/Read to enumerate AWS credentials IDs stored in Jenkins. The vulnerability arises from inadequate access control in the pl...

CVE-2023-41942

The CVE-2023-41942 entry concerns a CSRF vulnerability in the Jenkins AWS CodeCommit Trigger Plugin. Affected software: Jenkins AWS CodeCommit Trigger Plugin versions 3.0.12 and earlier. Root cause: cross-site request forgery that enables an attacker to clear the SQS queue. Impact: described as a...

CVE-2023-41944

CVE-2023-41944 concerns the Jenkins AWS CodeCommit Trigger Plugin (versions

CVE-2023-41943

CVE-2023-41943 concerns the Jenkins AWS CodeCommit Trigger Plugin, where versions 3.0.12 and earlier do not perform a permission check in an HTTP endpoint. The described impact is that attackers with Overall/Read permission can clear the SQS queue. The connected documents consistently reference t...

CVE-2023-35147

CVE-2023-35147 affects the Jenkins AWS CodeCommit Trigger Plugin, v3.0.12 and earlier. The issue arises because the HTTP endpoint does not restrict the AWS SQS queue name path parameter, enabling attackers with Item/Read permission to obtain contents of arbitrary files on the Jenkins controller f...