Missing permission checks in Jenkins Orka by MacStadium Plugin 1.31 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Affected Packages

Maven io.jenkins.plugins:macstadium-orka

Affected versions: 0 (fixed in 1.32)

Related CVEs

CVE-2023-24433

Key Information

GHSA ID

GHSA-gmhf-37fx-c4q8

Published

January 26, 2023 9:30 PM

Last Modified

February 3, 2023 8:40 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

io.jenkins.plugins:macstadium-orka

GitHub Reviewed

✓ Yes

Dataset

Last updated: August 25, 2025 6:33 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.