CVE Catalog
CVE-2023-35149
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk0.66%
47th percentile - higher than 47% of all known CVEs
Summary
A missing permission check in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL, capturing credentials stored in Jenkins.
Risk Assessment
The organization may be exposed to credential theft, potentially leading to unauthorized access to systems and data.
Recommendation
It is recommended to update the plugin to the latest version to eliminate the permission check vulnerability.
Original NVD description (English source)
A missing permission check in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL, capturing credentials stored in Jenkins.