CVE-2023-41945

published 2023-09-06

CVE-2023-41945: Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT permissions to be…

Priority P3 43 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT permissions to be granted Overall/Manage and Overall/SystemRead permissions, even if those permissions are disabled and should not be granted.

Affected

17 ranges

Vendor	Product	Version range	Fixed in
jenkins	assembla_auth	<= 1.14	—
jenkins	assembla_auth_plugin	—	—
jenkins	aws_codecommit_trigger_plugin	—	—
jenkins	bitbucket_push_and_pull_request_plugin	—	—
jenkins	config_file_provider_plugin	—	—
jenkins	disabled_permissions_can_be_granted_by_ssh2_easy_plugin	—	—
jenkins	disabled_permissions_granted_by_assembla_auth_plugin	—	—
jenkins	frugal_testing_plugin	—	—
jenkins	google_login_plugin	—	—
jenkins	ivy_plugin	—	—
jenkins	job_configuration_history_plugin	—	—
jenkins	non-constant_time_token_comparison_in_google_login_plugin	—	—
jenkins	pipeline_maven_integration_plugin	—	—
jenkins	qualys_container_scanning_connector_plugin	—	—
jenkins	ssh2_easy_plugin	—	—
jenkins	tap_plugin	—	—
jenkins_project	jenkins_assembla_auth_plugin	<= 1.14	—

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vendor_oracle 9.1 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-862