What is GHSA-vw64-g7c6-mm7g?

GHSA-vw64-g7c6-mm7g is a security advisory published by GitHub Security Advisories with Medium severity. Jenkins lambdatest-automation Plugin missing permission check

Which CVE IDs does GHSA-vw64-g7c6-mm7g cover?

GHSA-vw64-g7c6-mm7g covers the following CVE IDs: CVE-2023-46652. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vw64-g7c6-mm7g?

GHSA-vw64-g7c6-mm7g has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-vw64-g7c6-mm7g?

GHSA-vw64-g7c6-mm7g affects 1 product, including: maven/org.jenkins-ci.plugins:lambdatest-automation:\u003c 1.20.10.

GHSA-vw64-g7c6-mm7gMediumCVSS 4.3

Jenkins lambdatest-automation Plugin missing permission check

Vendor

GitHub Security Advisories

Published

October 25, 2023

Last Modified

November 11, 2023

🔗 CVE IDs covered (1)

CVE-2023-46652 →

📋 Description

Jenkins lambdatest-automation Plugin 1.20.9 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate credentials IDs of LAMBDATEST credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in lambdatest-automation Plugin 1.20.10 requires Overall/Administer permission.

🎯 Affected products1

maven/org.jenkins-ci.plugins:lambdatest-automation:< 1.20.10

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2023-46652
https://www.jenkins.io/security/advisory/2023-10-25/#SECURITY-3222
http://www.openwall.com/lists/oss-security/2023/10/25/2
https://github.com/advisories/GHSA-vw64-g7c6-mm7g