CVE-2023-40348
UNKNOWN
Published 2023-08-16T14:32:57.072Z
Actions:
Expert Analysis
Professional remediation guidance
Get tailored security recommendations from our analyst team for CVE-2023-40348. We'll provide specific mitigation strategies based on your environment and risk profile.
No CVSS data available
Description
The webhook endpoint in Jenkins Gogs Plugin 1.0.15 and earlier provides unauthenticated attackers information about the existence of jobs in its output.
Available Exploits
No exploits available for this CVE.
Related News
No news articles found for this CVE.
Affected Products
Affected Versions:
GitHub Security Advisories
Community-driven vulnerability intelligence from GitHub
✓ GitHub Reviewed
MODERATE
Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure
GHSA-qxwc-wchr-5h29Advisory Details
Jenkins Gogs Plugin provides a webhook endpoint at `/gogs-webhook` that can be used to trigger builds of jobs. In Gogs Plugin 1.0.15 and earlier, an option to specify a Gogs secret for this webhook is provided, but not enabled by default.
This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified job name.
Additionally, the output of the webhook endpoint includes whether a job corresponding to the attacker-specified job name exists, even if the attacker has no permission to access it.
As of publication of this advisory, there is no fix.
Affected Packages
Maven
org.jenkins-ci.plugins:gogs-webhook
ECOSYSTEM:
≥0
≤1.0.15
CVSS Scoring
CVSS Score
5.0
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
Advisory provided by GitHub Security Advisory Database. Published: August 16, 2023, Modified: August 16, 2023
References
Published: 2023-08-16T14:32:57.072Z
Last Modified: 2024-10-08T18:24:13.826Z
Copied to clipboard!