Skip to content
Sign in
6.5 Medium

CVE-2023-24435 A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with…

Description

A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Affected products and versions

Product Affected versions Fixed in
Jenkins GitHub Pull Request Builder Plugin 1.42 earliest → 1.42.2 No fix stated

Other CVEs of Jenkins GitHub Pull Request Builder Plugin

The 3 CVEs of Jenkins GitHub Pull Request Builder Plugin →
CVE-2023-24434 A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier… 8.8 High CVE-2023-24436 A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with… 4.3 Medium
Track this CVE