Vulnerabilities > CVE-2023-24425 - Unspecified vulnerability in Jenkins Kubernetes Credentials Provider

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

jenkins

NVD

Published: 2023-01-26

Updated: 2023-02-03

Summary

Jenkins Kubernetes Credentials Provider Plugin 1.208.v128ee9800c04 and earlier does not set the appropriate context for Kubernetes credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Kubernetes credentials they are not entitled to.

Vulnerable Configurations

Part	Description	Count
Application	Jenkins Jenkins Kubernetes Credentials Provider - Jenkins Kubernetes Credentials Provider 0.8 Jenkins Kubernetes Credentials Provider 0.9 Jenkins Kubernetes Credentials Provider 0.10 Jenkins Kubernetes Credentials Provider 0.11 Jenkins Kubernetes Credentials Provider 0.12.1 Jenkins Kubernetes Credentials Provider 0.13 Jenkins Kubernetes Credentials Provider 0.14 Jenkins Kubernetes Credentials Provider 0.15 Jenkins Kubernetes Credentials Provider 0.16 Jenkins Kubernetes Credentials Provider 0.17 Jenkins Kubernetes Credentials Provider 0.18 Jenkins Kubernetes Credentials Provider 0.18-1 Jenkins Kubernetes Credentials Provider 0.18.1 Jenkins Kubernetes Credentials Provider 0.19 Jenkins Kubernetes Credentials Provider 0.20 Jenkins Kubernetes Credentials Provider 0.21 Jenkins Kubernetes Credentials Provider 0.22 Jenkins Kubernetes Credentials Provider 1.196.Va_55F5E31E3C2 Jenkins Kubernetes Credentials Provider 1.199.V4A_1D1F5D074F Jenkins Kubernetes Credentials Provider 1.201.V11B_14C7A_0772 Jenkins Kubernetes Credentials Provider 1.206.V7Ce2Cf7B_0C8B Jenkins Kubernetes Credentials Provider 1.208.V128Ee9800C04	23

References

https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-3022