CVE-2023-40345 Jenkins Delphix Plugin vulnerable to exposure of system-scoped credentials
Attackers with read permissions can capture unauthorized credentials due to improper context handling in the Jenkins Delphix Plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-40345?
CVE-2023-40345 is a medium-severity vulnerability in Jenkins Delphix Plugin, published on 16 Aug 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Jenkins Delphix Plugin 3.0.2 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Overall/Read permission to access and capture credentials they are not entitled to.
Weakness: CWE-522
Which versions are affected by CVE-2023-40345?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:delphix. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:delphix Maven | All versions | 3.0.3 |
org.jenkins-ci.plugins:delphix Maven | All versions | 3.0.3 |
Products include Jenkins Delphix.
How do I fix CVE-2023-40345?
Upgrade org.jenkins-ci.plugins:delphix to 3.0.3 or later.
Is CVE-2023-40345 being exploited?
There is no known exploitation of CVE-2023-40345 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Delphix Plugin
- CVE-2019-10453 Jenkins Delphix Plugin vulnerable to Cleartext credential storage
- CVE-2024-28161 Jenkins Delphix Plugin has SSL/TLS certificate validation disabled by default
- CVE-2023-40344 Jenkins Delphix Plugin missing permission check
- CVE-2024-28162 Jenkins Delphix Plugin has improper SSL/TLS certificate validation
Sources
Also known as GHSA-wwww-xvm2-62w7.