CVE-2023-40344

A missing permission check in the Jenkins Delphix Plugin before version 3.0.3 allows attackers with Overall/Read permission to enumerate credential IDs stored in Jenkins [1]. The plugin fails to properly verify that the user has the necessary permission to list credentials, exposing sensitive metadata.

Exploitation requires only Overall/Read permission, which is often granted to low-privileged users [1]. The attack can be performed remotely over the network without any additional authentication, as the missing check is in a REST endpoint that does not enforce authorization.

An attacker can enumerate credential IDs, which can then be used in further attacks to potentially harvest the actual credentials, leading to broader compromise [1][2].

Jenkins has released Delphix Plugin version 3.0.3 that fixes this issue by adding the missing permission check [2]. Users are advised to upgrade to this version immediately to mitigate the vulnerability.