Improper access control in Red Hat Dependency Analytics - CVE-2024-23905

Detailed vulnerability description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to the affected plugin globally disables the Content-Security-Policy header for static files served by Jenkins whenever the "Invoke Red Hat Dependency Analytics (RHDA)" build step is executed. A remote user can bypass implemented security restrictions and gain unauthorized access to the application.

How to mitigate CVE-2024-23905

Sources

• https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3322
• http://www.openwall.com/lists/oss-security/2024/01/24/6