CVE-2023-35149

Summary

CVE-2023-35149 is a vulnerability affecting the Jenkins Digital.ai App Management Publisher Plugin version 2.6 and earlier. This issue involves a missing permission check, enabling users with Overall/Read access to connect to an attacker-specified URL. Consequently, attackers can capture Jenkins stored credentials, posing a significant security risk. Unauthorized access to Jenkins credentials can lead to data breaches, unauthorized changes, and other malicious activities. It is crucial for users to upgrade to a patched version of the plugin to mitigate this threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.