Vulnerability Description
Missing permission checks in Jenkins MATLAB Plugin 2.11.0 and earlier allow attackers to have Jenkins parse an XML file from the Jenkins controller file system.
CVSS Score
9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Matlab | < 2.11.1 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2023/11/29/1Mailing List
- https://www.jenkins.io/security/advisory/2023-11-29/#SECURITY-3193Vendor Advisory
- http://www.openwall.com/lists/oss-security/2023/11/29/1Mailing List
- https://www.jenkins.io/security/advisory/2023-11-29/#SECURITY-3193Vendor Advisory
FAQ
What is CVE-2023-49654?
CVE-2023-49654 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Missing permission checks in Jenkins MATLAB Plugin 2.11.0 and earlier allow attackers to have Jenkins parse an XML file from the Jenkins controller file system.
How severe is CVE-2023-49654?
CVE-2023-49654 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2023-49654?
Check the references section above for vendor advisories and patch information. Affected products include: Jenkins Matlab.