CVE-2023-49653 Jenkins Jira Plugin vulnerable to exposure of system-scoped credentials

What is CVE-2023-49653?

CVE-2023-49653 is a medium-severity vulnerability in Jenkins Jira Plugin, published on 29 Nov 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Jenkins Jira Plugin 3.11 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to.

Weakness: CWE-522

Which versions are affected by CVE-2023-49653?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:jira. It affects 1 product.

Products include Jenkins Jira.

How do I fix CVE-2023-49653?

Upgrade org.jenkins-ci.plugins:jira to 3.12 or later.

Is CVE-2023-49653 being exploited?

There is no known exploitation of CVE-2023-49653 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Jira Plugin

• CVE-2019-16541 Jenkins JIRA Plugin allows users to select and use credentials with System scope Critical 9.9
• CVE-2018-1000412 Jenkins Jira Plugin Incorrect Authorization vulnerability High 8.8
• CVE-2022-29041 Stored Cross-site Scripting vulnerability in Jenkins Jira Plugin Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qmhq-876f-cr65.