CVE-2023-24433 — Missing permission checks in Jenkins Orka Plugin allow capturing credentials

Description

Missing permission checks in Jenkins Orka by MacStadium Plugin 1.31 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

How to fix CVE-2023-24433

To remediate CVE-2023-24433, upgrade the affected package to a fixed version below.

—upgrade to 1.32 or later

Is CVE-2023-24433 being exploited?

Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

from 0, < 1.32

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References (2)

ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-24433
WEBwww.jenkins.io/security/advisory/2023-01-24/#SECURITY-2772%20(2)