CVE-2023-32988 Jenkins Azure VM Agents Plugin missing permission checks
Attackers with Overall/Read permission can enumerate stored credential IDs in the Jenkins Azure VM Agents Plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-32988?
CVE-2023-32988 is a medium-severity vulnerability in Jenkins Azure VM Agents Plugin, published on 16 May 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Weakness: CWE-522
Which versions are affected by CVE-2023-32988?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:azure-vm-agents. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:azure-vm-agents Maven | All versions | 853.v4a |
org.jenkins-ci.plugins:azure-vm-agents Maven | All versions | 853.v4a |
Products include Jenkins Azure Vm Agents.
How do I fix CVE-2023-32988?
Upgrade org.jenkins-ci.plugins:azure-vm-agents to 853.v4a or later.
Is CVE-2023-32988 being exploited?
There is no known exploitation of CVE-2023-32988 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Azure VM Agents Plugin
- CVE-2023-32989 Jenkins Azure VM Agents Plugin Cross-site Request Forgery vulnerability
- CVE-2023-32990 Jenkins Azure VM Agents Plugin missing permission checks
- CVE-2019-1003037 Unprivileged users with Overall/Read access are able to enumerate credential IDs in Azure VM Agents Plugin
- CVE-2019-1003035 Information disclosure in Azure VM Agents Plugin
- CVE-2019-1003036 Missing permission check in Azure VM Agents Plugin allowed modifying VM configuration
Sources
Also known as GHSA-q77x-cxrq-988j.