CVE-2023-24433

Name of the Vulnerable Software and Affected Versions Jenkins Orka by MacStadium Plugin versions 1.31 and earlier

Description The issue is related to missing permission checks, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs. This can lead to capturing credentials stored in Jenkins.

Recommendations For Jenkins Orka by MacStadium Plugin versions 1.31 and earlier, update to a version later than 1.31 to resolve the issue. As a temporary workaround, consider restricting access to the plugin for users with only Overall/Read permission to minimize the risk of exploitation.