Vulnerability Description
Jenkins SSH2 Easy Plugin 1.4 and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users formerly granted (typically optional permissions, like Overall/Manage) to access functionality they're no longer entitled to.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Ssh2 Easy | <= 1.4 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2023/09/06/9Mailing ListThird Party Advisory
- https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3064Vendor Advisory
- http://www.openwall.com/lists/oss-security/2023/09/06/9Mailing ListThird Party Advisory
- https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3064Vendor Advisory
FAQ
What is CVE-2023-41939?
CVE-2023-41939 is a vulnerability with a CVSS score of 8.8 (HIGH). Jenkins SSH2 Easy Plugin 1.4 and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users formerly granted (typically optional permissions, like Overal...
How severe is CVE-2023-41939?
CVE-2023-41939 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-41939?
Check the references section above for vendor advisories and patch information. Affected products include: Jenkins Ssh2 Easy.