CVE-2023-23848

Name of the Vulnerable Software and Affected Versions Synopsys Jenkins Coverity Plugin versions 3.0.2 and earlier

Description The issue is related to missing permission checks, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method. This can result in capturing credentials stored in Jenkins.

Recommendations For Synopsys Jenkins Coverity Plugin versions 3.0.2 and earlier, update to a version that includes the necessary permission checks to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.