CVE-2023-4302
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A missing permission check in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method.
Risk Assessment
Attackers can gain access to credentials stored in Jenkins, potentially leading to further attacks on the organization's infrastructure.
Recommendation
It is recommended to update the Fortify Plugin to the latest version to eliminate the permission check vulnerability.
Original NVD description (English source)
A missing permission check in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.