CVE-2023-49654 Jenkins MATLAB Plugin missing permission checks
Attackers can force Jenkins to parse arbitrary XML files from the controller file system due to missing permission checks in the MATLAB Plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-49654?
CVE-2023-49654 is a critical missing authorization vulnerability in Jenkins MATLAB Plugin, published on 29 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Missing permission checks in Jenkins MATLAB Plugin 2.11.0 and earlier allow attackers to have Jenkins parse an XML file from the Jenkins controller file system.
Weakness: CWE-862
Which versions are affected by CVE-2023-49654?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:matlab. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:matlab Maven | All versions | 2.11.1 |
org.jenkins-ci.plugins:matlab Maven | All versions | 2.11.1 |
Products include Jenkins Matlab.
How do I fix CVE-2023-49654?
Upgrade org.jenkins-ci.plugins:matlab to 2.11.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-49654 being exploited?
There is no known exploitation of CVE-2023-49654 in the wild and no public exploit code.
Other vulnerabilities in Jenkins MATLAB Plugin
Sources
Also known as GHSA-cv4x-9f34-8rp9.