CVE-2023-40347
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
The Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin version 1.14 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access credentials they are not entitled to.
Risk Assessment
Attackers may gain access to sensitive credentials, potentially leading to unauthorized access to the organization's systems and data.
Recommendation
It is recommended to update the plugin to the latest version to mitigate this security vulnerability.
Original NVD description (English source)
Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.14 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to.