CVE-2023-4302 - CVE House

Back to Database

Status published Medium CVE-2023-4302

Missing permission checks in Fortify Plugin allow capturing credentials

4.2 CVSS

Vulnerability Description

A missing permission check in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-4302

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Alvaro Muñoz (@pwntester), GitHub Security Lab
Kevin Guerroudj, CloudBees, Inc.

References

https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3115

More from Jenkins Project

View All →

Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and...

Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set...

Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the...

Jenkins Git client Plugin 6.4.0 and earlier does not not...

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and...

Affected Vendor

Jenkins Project

View all reports →

Affected Software

Jenkins Fortify Plugin

Vulnerable Versions:

0

Timeline

Official Publish: August 21st, 2023

Last Modified: October 1st, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1078 Valid Accounts

T1531 Account Access Removal