CVE-2023-28668 Jenkins Role-based Authorization Strategy Plugin grants permissions even after they’ve been disabled

Critical 9.8 Published 23 Mar 2023 Updated 25 Feb 2025

Attackers can retain unauthorized access in Jenkins because the Role-based Authorization Strategy Plugin fails to revoke permissions after they are disabled.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-28668?

CVE-2023-28668 is a critical missing authorization vulnerability in Jenkins Role-based Authorization Strategy Plugin, published on 23 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they've been disabled.

Weakness: CWE-281

Which versions are affected by CVE-2023-28668?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:role-strategy. It affects 1 product.

Package	Affected	Fixed in
`org.jenkins-ci.plugins:role-strategy` Maven	All versions	`587.588.v850a_20a_30162`
`org.jenkins-ci.plugins:role-strategy` Maven	All versions	`587.588.v850a_20a_30162`

Products include Jenkins Role-Based Authorization Strategy.

How do I fix CVE-2023-28668?

Upgrade org.jenkins-ci.plugins:role-strategy to 587.588.v850a_20a_30162 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-28668 being exploited?

There is no known exploitation of CVE-2023-28668 in the wild and no public exploit code.

Sources

Also known as GHSA-436g-2f92-cvhh.