CVE-2023-35149

MediumCVSS 6.5

Published: 14/06/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.66%

47th percentile - higher than 47% of all known CVEs

Summary

A missing permission check in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL, capturing credentials stored in Jenkins.

Risk Assessment

The organization may be exposed to credential theft, potentially leading to unauthorized access to systems and data.

Recommendation

It is recommended to update the plugin to the latest version to eliminate the permission check vulnerability.

Other vulnerabilities in Jenkins Digital.ai App Management Publisher Plugin

CVE-2023-35148Medium
The Jenkins Digital.ai App Management Publisher Plugin version 2.6 and earlier contains a cross-site request forgery (CSRF) vulnerability that allows attackers to connect to an attacker-specified URL, capturing credentials stored in Jenkins.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS