CVE-2023-28668

EPSS 0.1%
Published 02.04.2023 21:15:08
Last modified 25.02.2025 20:15:32
Source jenkinsci-cert@googlegroups.co
Teams watchlist Login
Open Login

Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they've been disabled.

Affected products Warnungen 0 Metrics 3 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Jenkins ≫ Role-based Authorization Strategy SwPlatformjenkins Version <= 587.v2872c41fa_e51

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.1%	0.294

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-281 Improper Preservation of Permissions

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-3053

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2023-28668

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-28668

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-28668

EUVD