Critical severity · published Nov 29, 2023
CVE-2023-49654
Missing permission checks in Jenkins MATLAB Plugin 2.11.0 and earlier allow attackers to have Jenkins parse an XML file from the Jenkins controller file system
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
Missing permission checks in Jenkins MATLAB Plugin 2.11.0 and earlier allow attackers to have Jenkins parse an XML file from the Jenkins controller file system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Matlab · Jenkins
before 2.11.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-49654
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-49654
Mailing List
http://www.openwall.com/lists/oss-security/2023/11/29/1
Vendor Advisory
https://www.jenkins.io/security/advisory/2023-11-29/#SECURITY-3193
More from Matlab
9.8
CVE-2023-49656
Jenkins MATLAB Plugin 2.11.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks
8.8
CVE-2023-49673
A cross-site request forgery (CSRF) vulnerability in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers to connect to an attacker-specified hostname…
8.8
CVE-2023-49655
A cross-site request forgery (CSRF) vulnerability in Jenkins MATLAB Plugin 2.11.0 and earlier allows attackers to have Jenkins parse an XML file from the Jenkins controller file…