CVE-2023-41941: 
Java vulnerability analysis and mitigation

AWS CodeCommit Trigger Plugin version 3.0.12 and earlier contains a security vulnerability (CVE-2023-41941) that was disclosed on September 6, 2023. The vulnerability is characterized by a missing permission check in an HTTP endpoint, affecting the plugin's security controls. This vulnerability has been assessed as Medium severity with a CVSS v3.1 base score of 4.3 (Jenkins Advisory).

The vulnerability stems from the AWS CodeCommit Trigger Plugin's failure to perform proper permission checks in an HTTP endpoint. The technical issue allows attackers who possess Overall/Read permission to enumerate credentials IDs of AWS credentials that are stored in Jenkins (Jenkins Advisory, OSS Security).

The primary impact of this vulnerability is that it enables attackers to enumerate credentials IDs of AWS credentials stored in Jenkins. These enumerated credentials IDs can potentially be used as part of a broader attack to capture the actual credentials when combined with other vulnerabilities (Jenkins Advisory).

As of the advisory's publication date, there is no fix available for this vulnerability in the AWS CodeCommit Trigger Plugin. Organizations using affected versions (3.0.12 and earlier) should assess their risk and consider implementing additional security controls to protect AWS credentials stored in Jenkins (Jenkins Advisory).