CVE-2023-28668

EPSS 0.1%
Veröffentlicht 02.04.2023 21:15:08
Zuletzt bearbeitet 25.02.2025 20:15:32
Quelle jenkinsci-cert@googlegroups.co
Teams Watchlist Login
Unerledigt Login

Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they've been disabled.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Jenkins ≫ Role-based Authorization Strategy SwPlatformjenkins Version <= 587.v2872c41fa_e51

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.1%	0.294

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-281 Improper Preservation of Permissions

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-3053

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2023-28668

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-28668

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-28668

EUVD