Jenkins OpenTelemetry Plugin Missing Permission Check Vulnerability Allows Credential Capture

A vulnerability exists in Jenkins OpenTelemetry Plugin versions through 3.1543.v8446b_92b_cd64, due to a missing permission check. This flaw enables attackers with Overall/Read permission to connect to a URL of their choice, using credentials IDs obtained through other means, to capture credentials stored in Jenkins.

Impact

Exploitation of this vulnerability allows for unauthorized access to Jenkins-stored credentials, potentially leading to further exploitation within the Jenkins environment.

Remediation

Users of the OpenTelemetry Plugin should update to version 3.1543.1545.vf5a_4ec123769, which requires Overall/Administer permission for the affected form validation method.