CVE-2023-32988: 
Java vulnerability analysis and mitigation

A missing permission check vulnerability was discovered in Jenkins Azure VM Agents Plugin versions 852.v8d35f0960a_43 and earlier, identified as CVE-2023-32988. The vulnerability was disclosed on May 16, 2023, affecting the Azure VM Agents Plugin component. This security flaw allows attackers with Overall/Read permission to enumerate credentials IDs stored in Jenkins (Jenkins Advisory).

The vulnerability stems from the absence of a permission check in an HTTP endpoint within the Azure VM Agents Plugin. The issue has a CVSS v3.1 Base Score of 4.3 (Medium) with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified under CWE-522 (Insufficiently Protected Credentials) (NVD).

The vulnerability enables attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. These enumerated credentials IDs could potentially be used as part of a broader attack to capture the actual credentials through another vulnerability (Jenkins Advisory).

The vulnerability requires an attacker to have Overall/Read permission in the Jenkins environment. The exploitation is straightforward once this access level is obtained, as it involves accessing an HTTP endpoint that lacks proper permission checks (Jenkins Advisory).

The vulnerability has been fixed in Azure VM Agents Plugin version 853.v4a_1a_dd947520, which now requires Overall/Administer permission for credentials IDs enumeration. Users are advised to upgrade to this version or later to address the security issue (Jenkins Advisory).