Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-35149

CVE-2023-35149: Jenkins Digital.ai App Management Publisher Plugin missing permission checks

4.2

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-35149
GHSA ID
GHSA-5ghv-wxh9-7356
EPSS Score
0.15006%
CWE
CWE-862
Published
6/14/2023
Updated
11/4/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jenkins-ci.plugins:ease-pluginmaven<= 2.6

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from HTTP endpoints in the plugin that handle credential verification and connection testing. Jenkins plugins typically implement such endpoints via Stapler actions in DescriptorImpl classes. The advisory explicitly states these endpoints lack permission checks (CWE-862) and CSRF protections (allowing GET requests). While exact method names aren't provided in public disclosures, methods like doVerifyCredentials and doTestConnection are common patterns for credential-related endpoints in Jenkins plugins. The confidence is 'medium' because the assessment relies on Jenkins plugin architecture conventions rather than direct code evidence.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

J*nkins *i*it*l.*i *pp M*n***m*nt Pu*lis**r Plu*in *.* *n* **rli*r *o*s not p*r*orm p*rmission ****ks in s*v*r*l *TTP *n*points. T*is *llows *tt**k*rs wit* Ov*r*ll/R*** p*rmission to *onn**t to *n *tt**k*r-sp**i*i** URL usin* *tt**k*r-sp**i*i** *r**

Reasoning

T** vuln*r**ility st*ms *rom *TTP *n*points in t** plu*in t**t **n*l* *r***nti*l v*ri*i**tion *n* *onn**tion t*stin*. J*nkins plu*ins typi**lly impl*m*nt su** *n*points vi* St*pl*r **tions in **s*riptorImpl *l*ss*s. T** **visory *xpli*itly st*t*s t**