CVE-2023-50765: Missing permission check in Jenkins Scriptler Plugin

December 13, 2023 (updated December 18, 2023)

A missing permission check in Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier allows attackers with Overall/Read permission to read the contents of a Groovy script by knowing its ID.

References

www.openwall.com/lists/oss-security/2023/12/13/4
github.com/advisories/GHSA-4j42-6xfx-h754
github.com/jenkinsci/scriptler-plugin/commit/5addb5f9e68596abdba216e61cf714c2767b874b
nvd.nist.gov/vuln/detail/CVE-2023-50765
www.jenkins.io/security/advisory/2023-12-13/

Code Behaviors & Features

Detect and mitigate CVE-2023-50765 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →