CVE-2023-2196 - Missing permission checks in Code Dx Plugin

Back Back to CVE browser

MEDIUM

Missing permission checks in Code Dx Plugin

Published May 16, 2023

4.3

MEDIUM

CVSS 3.1

EPSS 0.95%

Description

A missing permission check in Jenkins Code Dx Plugin 3.1.0 and earlier allows attackers with Item/Read permission to check for the existence of an attacker-specified file path on an agent file system.

Affected products

Vendor Jenkins Product Jenkins Code Dx Plugin Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=3.1.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Jenkins

Jenkins Code Dx Plugin

unaffected

Version	Status	Constraints
0	affected	<=3.1.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (5)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-1475		Advisory
https://github.com/advisories/GHSA-5gjq-5339-x5cv		Advisory
https://github.com/jenkinsci/codedx-plugin/commit/138932b362c7da3c310b1f34fc854c5bf5f52458
https://nvd.nist.gov/vuln/detail/CVE-2023-2196
https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3145		Vendor Advisory