CVE-2023-41945 Disabled permissions granted by Jenkins Assembla Auth Plugin
Attackers with edit permissions can gain unauthorized system management and read access due to missing permission verification in the Jenkins Assembla Auth Plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-41945?
CVE-2023-41945 is a high-severity vulnerability in Jenkins Assembla Auth Plugin, published on 6 Sep 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT permissions to be granted Overall/Manage and Overall/SystemRead permissions, even if those permissions are disabled and should not be granted.
Weakness: CWE-862
Which versions are affected by CVE-2023-41945?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:assembla-auth. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:assembla-auth Maven | All versions to 1.14 | None |
org.jenkins-ci.plugins:assembla-auth Maven | All versions to 1.14 | None |
Products include Jenkins Assembla Auth.
How do I fix CVE-2023-41945?
No fix has been published for CVE-2023-41945 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-41945 being exploited?
There is no known exploitation of CVE-2023-41945 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Assembla Auth Plugin
Sources
Also known as GHSA-qf42-f5vf-6w99.