Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-50769

CVE-2023-50769:
Jenkins Nexus Platform Plugin missing permission check

4.2

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-50769
GHSA ID
GHSA-4g5f-w3mh-w99m
EPSS Score
0.16017%
CWE
CWE-862
Published
12/13/2023
Updated
12/18/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.sonatype.nexus.ci:nexus-jenkins-pluginmaven< 3.18.1-013.18.1-01

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from form validation methods that lacked both permission checks (requiring only Overall/Read instead of ADMINISTER) and CSRF protections (allowing GET requests). The GitHub commit explicitly adds @POST annotations and Jenkins.ADMINISTER checks to these specific methods across multiple configuration classes, confirming they were the vulnerable endpoints. The direct correlation between the patch and these functions' security improvements provides high confidence in identification.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

J*nkins N*xus Pl*t*orm Plu*in *.**.*-** *n* **rli*r *o*s not p*r*orm p*rmission ****ks in m*t*o*s impl*m*ntin* *orm v*li**tion. T*is *llows *tt**k*rs wit* Ov*r*ll/R*** p*rmission to *onn**t to *n *tt**k*r-sp**i*i** *TTP s*rv*r usin* *tt**k*r-sp**i*i

Reasoning

T** vuln*r**ility st*ms *rom *orm v*li**tion m*t*o*s t**t l**k** *ot* p*rmission ****ks (r*quirin* only Ov*r*ll/R*** inst*** o* **MINIST*R) *n* *SR* prot**tions (*llowin* **T r*qu*sts). T** *it*u* *ommit *xpli*itly ***s `@POST` *nnot*tions *n* `J*nki