Description
Jenkins Delphix Plugin 3.0.2 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Overall/Read permission to access and capture credentials they are not entitled to.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Jenkins Project Jenkins Delphix Plugin
Default version status: unaffected
0 to ≤ 3.0.2affected
References
- https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3214%20(2) ↗
- http://www.openwall.com/lists/oss-security/2023/08/16/3 ↗
- https://support.delphix.com/Support_Policies_and_Technical_Bulletins/Technical_Bulletins/TB111_Delphix_Plugin_for_Jenkins_Vulnerable_to_Credential_Enumeration_and_Capture ↗