CVE-2023-30518: Jenkins Thycotic Secret Server Plugin missing permissions check
4.3
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.17077%
CWE
Published
4/12/2023
Updated
4/21/2023
KEV Status
No
Technology
Java
JavaTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.jenkins.plugins:thycotic-secret-server | maven | <= 1.0.2 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability explicitly involves an unauthenticated HTTP endpoint for credential ID enumeration. In Jenkins plugin architecture:
- Credential providers typically implement specific methods for credential management
- HTTP endpoints are usually handled via Stapler routing or WebMethod annotations
- The missing permission check strongly suggests an absence of Jenkins.get().checkPermission() or similar authorization calls
- The credentials ID enumeration capability aligns with a GET handler method returning credential references While exact code isn't available, the pattern matches Jenkins vulnerability patterns for CWE-862 where endpoints lack requirePermission checks.