CVE-2023-41945

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT permissions to be granted Overall/Manage and Overall/SystemRead permissions, even if those permissions are disabled and should not be granted.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Jenkins Project	Jenkins Assembla Auth Plugin	<= 1.14

References

http://www.openwall.com/lists/oss-security/2023/09/06/9Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3065Vendor Advisory
http://www.openwall.com/lists/oss-security/2023/09/06/9Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3065Vendor Advisory

Timeline

Published: Sep 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-419463.5A cross-site request forgery (CSRF) vulnerability in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers to connect to Frugal Tes CVE-2023-419474.3A missing permission check in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to Frug CVE-2023-419484.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Christoph Rado Cookie Notice & Consent plugin <= 1.6.0 versions.CVE-2023-419494.8Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Avirtum iFolders plugin <= 1.5.0 versions.CVE-2023-41958.8PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3.CVE-2023-419508.8Cross-Site Request Forgery (CSRF) vulnerability in Laposta - Roel Bousardt Laposta Signup Basic plugin <= 1.4.1 versions.CVE-2023-419514.3Missing Authorization vulnerability in rtCamp rtMedia for WordPress, BuddyPress and bbPress allows Exploiting Incorrectly Configured Access CVE-2023-419525.3Missing Authorization vulnerability in Contact Form - WPManageNinja LLC FluentForm allows Exploiting Incorrectly Configured Access Control S CVE-2023-419535.3Missing Authorization vulnerability in ProfilePress Membership Team ProfilePress.This issue affects ProfilePress: from n/a through 4.13.1.CVE-2023-419548.6Improper Privilege Management vulnerability in ProfilePress Membership Team ProfilePress allows Privilege Escalation.This issue affects Prof CVE-2023-419558.8Improper Privilege Management vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation.This issue affects Ess CVE-2023-419568.8Improper Authentication vulnerability in smp7, wp.Insider Simple Membership.This issue affects Simple Membership: from n/a through 4.3.4.