CVE-2023-32988: 
Java vulnerability analysis and mitigation

A missing permission check vulnerability was discovered in Jenkins Azure VM Agents Plugin versions 852.v8d35f0960a_43 and earlier, identified as CVE-2023-32988. The vulnerability was disclosed on May 16, 2023, affecting the Azure VM Agents Plugin component. This security flaw allows attackers with Overall/Read permission to enumerate credentials IDs stored in Jenkins (Jenkins Advisory).

The vulnerability stems from the absence of a permission check in an HTTP endpoint within the Azure VM Agents Plugin. The issue has a CVSS v3.1 Base Score of 4.3 (Medium) with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified under CWE-522 (Insufficiently Protected Credentials) (NVD).

The vulnerability enables attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. These enumerated credentials IDs could potentially be used as part of a broader attack to capture the actual credentials through another vulnerability (Jenkins Advisory).

The vulnerability has been fixed in Azure VM Agents Plugin version 853.v4a1add947520, which now requires Overall/Administer permission for credentials IDs enumeration. Users are advised to upgrade to this version or later to address the security issue (Jenkins Advisory).