Description
A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Remediation
References
https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2789%20%281%29
Related Vulnerabilities
CVE-2015-8797 Vulnerability in maven package org.apache.solr:solr
CVE-2022-41930 Vulnerability in maven package org.xwiki.platform:xwiki-platform-user-profile-ui
CVE-2023-2585 Vulnerability in maven package org.keycloak:keycloak-services
CVE-2023-28158 Vulnerability in maven package org.apache.archiva:archiva-web-common
CVE-2011-3375 Vulnerability in maven package org.apache.tomcat:catalina