cbcvebase.
CVE-2023-24453
published 2023-01-26

CVE-2023-24453: A missing check in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL…

PriorityP338medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
EPSS
0.72%
49.8th percentile
A missing check in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.

Affected

23 ranges
VendorProductVersion rangeFixed in
jenkinsbearychat_plugin——
jenkinsbitbucket_oauth_plugin——
jenkinscisco_spark_notifier_plugin——
jenkinsgerrit_trigger_plugin——
jenkinsgithub_pull_request_builder_plugin——
jenkinsgithub_pull_request_coverage_status_plugin——
jenkinsids_in_orka_by_macstadium_plugin——
jenkinsjira_pipeline_steps_plugin——
jenkinskeycloak_authentication_plugin——
jenkinskubernetes_credentials_provider_plugin——
jenkinsmacstadium_plugin——
jenkinsmstest_plugin——
jenkinsopenid_connect_authentication_plugin——
jenkinsopenid_plugin——
jenkinsorka_by_macstadium_plugin——
jenkinspwauth_security_realm_plugin——
jenkinsrabbitmq_consumer_plugin——
jenkinsscript_security_plugin——
jenkinssemantic_versioning_plugin——
jenkinstestcomplete_support_plugin——
jenkinstestquality_updater<= 1.3—
jenkinstestquality_updater_plugin——
jenkins_projectjenkins_testquality_updater_pluginunspecified – 1.3—
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.