{"id":"CVE-2023-32261","aliases":["EUVD-2023-1923","GHSA-27pr-r7hm-c2rc"],"status":"published","title":"Dimensions CM Plugin for Jenkins 0.8.17 – 0.9.3","description":"A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.\nSee the following Jenkins security advisory for details:  *   https://www.jenkins.io/security/advisory/2023-06-14/ https://www.jenkins.io/security/advisory/2023-06-14/","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00625,"percentile":0.50306,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2023-07-19T15:56:25Z","modified":"2026-10-24T10:30:26Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:dimensionsscm","fixed_in":["0.9.3.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:dimensionsscm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.9.3"},{"fixed":"0.9.3.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:dimensionsscm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3.1"}]}],"versions":["0.7.11","0.8.1","0.8.10","0.8.11","0.8.12","0.8.13","0.8.14","0.8.15","0.8.16","0.8.17","0.8.18","0.8.19","0.8.3.1","0.8.5","0.8.6","0.8.8","0.8.9","0.9.0","0.9.1","0.9.2","0.9.3"]}],"products":[{"vendor":"micro focus","product":"dimensions cm"},{"vendor":"microfocus","product":"dimensions_cm"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2023-06-14/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://plugins.jenkins.io/dimensionsscm/","tags":["x_transferred","Product","web"]},{"url":"https://portal.microfocus.com/s/article/KM000019297","tags":["x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32261","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-3138","tags":["web"]},{"url":"https://plugins.jenkins.io/dimensionsscm","tags":["web"]},{"url":"https://www.jenkins.io/security/advisory/2023-06-14","tags":["web"]},{"url":"https://github.com/advisories/GHSA-27pr-r7hm-c2rc"}],"sources":{"cve":[{"id":"CVE-2023-32261","title":"Dimensions CM Plugin for Jenkins 0.8.17 – 0.9.3","description":"\nA potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.\nSee the following Jenkins security advisory for details:  *   https://www.jenkins.io/security/advisory/2023-06-14/ https://www.jenkins.io/security/advisory/2023-06-14/ \n\n\n\n\n","status":"published","published":"2023-07-19T15:56:25.049Z","modified":"2024-10-29T19:28:56.246Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:35:29.01154Z"}],"euvd":[{"id":"EUVD-2023-1923","description":"\nA potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.\nSee the following Jenkins security advisory for details:  *   https://www.jenkins.io/security/advisory/2023-06-14/ https://www.jenkins.io/security/advisory/2023-06-14/ \n\n\n\n\n","status":"published","published":"2023-07-19T15:56:25Z","modified":"2024-10-29T19:28:56Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:05:14.718275Z"}],"ghsa":[{"id":"GHSA-27pr-r7hm-c2rc","title":"Missing permission check in Jenkins Dimensions Plugin allows enumerating credentials IDs","description":"Dimensions Plugin 0.9.3 and earlier does not perform a permission check in an HTTP endpoint.\n\nThis allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.\n\nAn enumeration of credentials IDs in Dimensions Plugin 0.9.3.1 requires the appropriate permissions.","status":"published","published":"2023-07-19T18:30:55Z","modified":"2024-10-29T21:49:05Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:38:14.769863Z"}],"nvd":[{"id":"CVE-2023-32261","description":"\nA potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.\nSee the following Jenkins security advisory for details:  *   https://www.jenkins.io/security/advisory/2023-06-14/ https://www.jenkins.io/security/advisory/2023-06-14/ \n\n\n\n\n","status":"published","published":"2023-07-19T16:15:09.737Z","modified":"2026-06-17T05:58:26.243Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:08:17.044696Z"}],"osv":[{"id":"CVE-2023-32261","description":"\nA potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.\nSee the following Jenkins security advisory for details:  *   https://www.jenkins.io/security/advisory/2023-06-14/ https://www.jenkins.io/security/advisory/2023-06-14/ \n\n\n\n\n","status":"published","published":"2023-07-19T16:15:09.737Z","modified":"2026-10-24T10:30:26.672967782Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:31.790231Z"},{"id":"GHSA-27pr-r7hm-c2rc","title":"Missing permission check in Jenkins Dimensions Plugin allows enumerating credentials IDs","description":"Dimensions Plugin 0.9.3 and earlier does not perform a permission check in an HTTP endpoint.\n\nThis allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.\n\nAn enumeration of credentials IDs in Dimensions Plugin 0.9.3.1 requires the appropriate permissions.","status":"published","published":"2023-07-19T18:30:55Z","modified":"2024-10-29T22:01:11.232819Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:33.956911Z"}]}}