CVE-2023-40349
published 2023-08-16CVE-2023-40349: Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds of…
PriorityP430medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.68%
51.9th percentile
Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds of jobs.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | blue_ocean_plugin | — | — |
| jenkins | config_file_provider_plugin | — | — |
| jenkins | delphix_plugin | — | — |
| jenkins | docker_swarm_plugin | — | — |
| jenkins | favorite_view_plugin | — | — |
| jenkins | flaky_test_handler_plugin | — | — |
| jenkins | folders_plugin | — | — |
| jenkins | fortify_plugin | — | — |
| jenkins | gogs | <= 1.0.15 | — |
| jenkins | gogs_plugin | — | — |
| jenkins | improper_masking_of_credentials_in_nodejs_plugin | — | — |
| jenkins | nodejs_plugin | — | — |
| jenkins | shortcut_job_plugin | — | — |
| jenkins | tuleap_authentication_plugin | — | — |
| jenkins_project | jenkins_gogs_plugin | <= 1.0.15 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure
ghsa·2023-08-16
CVE-2023-40349 [MEDIUM] CWE-665 Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure
Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure
Jenkins Gogs Plugin provides a webhook endpoint at /gogs-webhook that can be used to trigger builds of jobs. In Gogs Plugin 1.0.15 and earlier, an option to specify a Gogs secret for this webhook is provided, but not enabled by default.
This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified job name.
Additionally, the output of the webhook endpoint includes whether a job corresponding to the attacker-specified job name exists, even if the attacker has no permission to access it.
As of publication of this advisory, there is no fix.
OSV
Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure
osv·2023-08-16
CVE-2023-40349 [MEDIUM] Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure
Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure
Jenkins Gogs Plugin provides a webhook endpoint at /gogs-webhook that can be used to trigger builds of jobs. In Gogs Plugin 1.0.15 and earlier, an option to specify a Gogs secret for this webhook is provided, but not enabled by default.
This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified job name.
Additionally, the output of the webhook endpoint includes whether a job corresponding to the attacker-specified job name exists, even if the attacker has no permission to access it.
As of publication of this advisory, there is no fix.
Jenkins
Jenkins Security Advisory 2023-08-16
vendor_jenkins·2023-08-16·CVSS 8.8
CVE-2023-40336 [HIGH] Jenkins Security Advisory 2023-08-16
Title: Jenkins Security Advisory 2023-08-16
Jenkins Security Advisory 2023-08-16
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Blue Ocean
Plugin
Config File Provider
Plugin
Delphix
Plugin
Docker Swarm
Plugin
Favorite View
Plugin
Flaky Test Handler
Plugin
Folders
Plugin
Fortify
Plugin
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-08-16
Published