CVE-2023-40349
UNKNOWN
Published 2023-08-16T14:32:57.708Z
Actions:
Expert Analysis
Professional remediation guidance
Get tailored security recommendations from our analyst team for CVE-2023-40349. We'll provide specific mitigation strategies based on your environment and risk profile.
No CVSS data available
Description
Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds of jobs.
Available Exploits
No exploits available for this CVE.
Related News
No news articles found for this CVE.
Affected Products
Affected Versions:
GitHub Security Advisories
Community-driven vulnerability intelligence from GitHub
✓ GitHub Reviewed
MODERATE
Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure
GHSA-rc33-44qp-vpvqAdvisory Details
Jenkins Gogs Plugin provides a webhook endpoint at /gogs-webhook that can be used to trigger builds of jobs. In Gogs Plugin 1.0.15 and earlier, an option to specify a Gogs secret for this webhook is provided, but not enabled by default.
This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified job name.
Additionally, the output of the webhook endpoint includes whether a job corresponding to the attacker-specified job name exists, even if the attacker has no permission to access it.
As of publication of this advisory, there is no fix.
Affected Packages
Maven
org.jenkins-ci.plugins:gogs-webhook
ECOSYSTEM:
≥0
≤1.0.15
CVSS Scoring
CVSS Score
5.0
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
Advisory provided by GitHub Security Advisory Database. Published: August 16, 2023, Modified: August 16, 2023
References
Published: 2023-08-16T14:32:57.708Z
Last Modified: 2024-10-08T18:22:33.595Z
Copied to clipboard!