From 0e7c35e793555b45206ee5f76f4ad06040e49a25 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 22 Jan 2025 19:10:00 +0000
Subject: [PATCH] Publish Advisories

GHSA-xhgq-h98j-859v
GHSA-xhgq-h98j-859v
---
 .../GHSA-xhgq-h98j-859v.json                  | 61 +++++++++++++++++++
 .../GHSA-xhgq-h98j-859v.json                  | 29 ---------
 2 files changed, 61 insertions(+), 29 deletions(-)
 create mode 100644 advisories/github-reviewed/2025/01/GHSA-xhgq-h98j-859v/GHSA-xhgq-h98j-859v.json
 delete mode 100644 advisories/unreviewed/2025/01/GHSA-xhgq-h98j-859v/GHSA-xhgq-h98j-859v.json

diff --git a/advisories/github-reviewed/2025/01/GHSA-xhgq-h98j-859v/GHSA-xhgq-h98j-859v.json b/advisories/github-reviewed/2025/01/GHSA-xhgq-h98j-859v/GHSA-xhgq-h98j-859v.json
new file mode 100644
index 00000000000..1f245d1c0a5
--- /dev/null
+++ b/advisories/github-reviewed/2025/01/GHSA-xhgq-h98j-859v/GHSA-xhgq-h98j-859v.json
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-xhgq-h98j-859v",
+  "modified": "2025-01-22T19:08:13Z",
+  "published": "2025-01-22T18:31:55Z",
+  "aliases": [
+    "CVE-2025-24397"
+  ],
+  "summary": "Incorrect permission check in Jenkins GitLab Plugin allows enumerating credentials IDs ",
+  "details": "The Jenkins GitLab Plugin 1.9.6 and earlier does not correctly perform a permission check in an HTTP endpoint.\n\nThis allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credential IDs of GitLab API token credentials and Secret text credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.\n\nAn enumeration of credential IDs in GitLab Plugin 1.9.7 requires Overall/Administer permission.\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.jenkins-ci.plugins:gitlab-plugin"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.9.7"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24397"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/jenkinsci/gitlab-plugin"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.jenkins.io/security/advisory/2025-01-22/#SECURITY-3260"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-285"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-01-22T19:08:12Z",
+    "nvd_published_at": "2025-01-22T17:15:13Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/01/GHSA-xhgq-h98j-859v/GHSA-xhgq-h98j-859v.json b/advisories/unreviewed/2025/01/GHSA-xhgq-h98j-859v/GHSA-xhgq-h98j-859v.json
deleted file mode 100644
index 532d38244d0..00000000000
--- a/advisories/unreviewed/2025/01/GHSA-xhgq-h98j-859v/GHSA-xhgq-h98j-859v.json
+++ /dev/null
@@ -1,29 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-xhgq-h98j-859v",
-  "modified": "2025-01-22T18:31:56Z",
-  "published": "2025-01-22T18:31:55Z",
-  "aliases": [
-    "CVE-2025-24397"
-  ],
-  "details": "An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credential IDs of GitLab API token and Secret text credentials stored in Jenkins.",
-  "severity": [],
-  "affected": [],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24397"
-    },
-    {
-      "type": "WEB",
-      "url": "https://www.jenkins.io/security/advisory/2025-01-22/#SECURITY-3260"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2025-01-22T17:15:13Z"
-  }
-}
\ No newline at end of file