{"id":"CVE-2023-49653","aliases":["EUVD-2023-3018","GHSA-qmhq-876f-cr65"],"status":"published","title":"Jenkins Jira Plugin vulnerable to exposure of system-scoped credentials","description":"Jenkins Jira Plugin 3.11 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0061,"percentile":0.49493,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-522"],"published":"2023-11-29T13:45:10Z","modified":"2026-10-24T10:31:05Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:jira","fixed_in":["3.12"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:jira","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:jira","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12"}]}],"versions":["1.27","1.28","1.29","1.30","1.31","1.32","1.33","1.34","1.35","1.36","1.37","1.38","1.39","1.41","2.0","2.0.2","2.0.3","2.1","2.2","2.2.1","2.3","2.3.1","2.4","2.4.2","2.5","2.5.1","2.5.2","3.0.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.15","3.0.16","3.0.17","3.0.18","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.6.1","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.10","3.11","3.2","3.2.1","3.3","3.4","3.5","3.6","3.6.1","3.7","3.7.1","3.8","3.9"]}],"products":[{"vendor":"jenkins","product":"jira"},{"vendor":"jenkins project","product":"jenkins jira plugin"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2023-11-29/#SECURITY-3225","tags":["vendor-advisory","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/11/29/1","tags":["x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49653","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qmhq-876f-cr65"}],"sources":{"cve":[{"id":"CVE-2023-49653","description":"Jenkins Jira Plugin 3.11 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to.","status":"published","published":"2023-11-29T13:45:10.268Z","modified":"2025-02-13T17:18:47.248Z","updated_at":"2026-11-02T14:35:12.998024Z"}],"euvd":[{"id":"EUVD-2023-3018","description":"Jenkins Jira Plugin 3.11 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to.","status":"published","published":"2023-11-29T13:45:10Z","modified":"2025-02-13T17:18:47Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"none"}],"updated_at":"2026-11-03T00:03:48.029386Z"}],"ghsa":[{"id":"GHSA-qmhq-876f-cr65","title":"Jenkins Jira Plugin vulnerable to exposure of system-scoped credentials","description":"Jenkins Jira Plugin 3.11 and earlier does not set the appropriate context for credentials lookup, allowing the use of system-scoped credentials otherwise reserved for the global configuration.\n\nThis allows attackers with Item/Configure permission to access and capture credentials they are not entitled to.\n\nJira Plugin 3.12 defines the appropriate context for credentials lookup.","status":"published","published":"2023-11-29T15:30:21Z","modified":"2023-12-05T22:59:04Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:37:23.843848Z"}],"nvd":[{"id":"CVE-2023-49653","description":"Jenkins Jira Plugin 3.11 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to.","status":"published","published":"2023-11-29T14:15:07.527Z","modified":"2026-06-17T06:36:16.617Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:08:49.393375Z"}],"osv":[{"id":"CVE-2023-49653","description":"Jenkins Jira Plugin 3.11 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to.","status":"published","published":"2023-11-29T14:15:07.527Z","modified":"2026-10-24T10:31:05.823911982Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:34.72355Z"},{"id":"GHSA-qmhq-876f-cr65","title":"Jenkins Jira Plugin vulnerable to exposure of system-scoped credentials","description":"Jenkins Jira Plugin 3.11 and earlier does not set the appropriate context for credentials lookup, allowing the use of system-scoped credentials otherwise reserved for the global configuration.\n\nThis allows attackers with Item/Configure permission to access and capture credentials they are not entitled to.\n\nJira Plugin 3.12 defines the appropriate context for credentials lookup.","status":"published","published":"2023-11-29T15:30:21Z","modified":"2024-02-16T08:10:53.464806Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T15:46:54.760124Z"}]}}