← All advisories

Moderate severityNVD Advisory· Published Mar 23, 2023· Updated Feb 25, 2025

CVE-2023-28668

CVE-2023-28668

Description

Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they've been disabled.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:role-strategyMaven	< 587.588.v850a_20a_30162	587.588.v850a_20a_30162

Affected products

2

ghsa-coords
pkg:maven/org.jenkins-ci.plugins/role-strategy
Range: < 587.588.v850a_20a_30162
Jenkins Project/Role Based Authorization Strategycpe-rescue
Range: 0

Patches

Vulnerability mechanics

References

4

github.com/advisories/GHSA-436g-2f92-cvhhghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-28668ghsaADVISORY
www.jenkins.io/security/advisory/2023-03-21/ghsavendor-advisoryWEB
github.com/jenkinsci/role-strategy-plugin/commit/850a20a3016276d0c0ba4898a876c113a9191da4ghsaWEB

News mentions

1

Jenkins Security Advisory 2023-03-21
Jenkins Security Advisories · Mar 21, 2023