GHSA-x263-hp5c-p2rj
GitHub Security Advisory
Jenkins OctoPerf Load Testing Plugin vulnerable to Cross-site Request Forgery
✓ GitHub Reviewed
MODERATE
Has CVE
Advisory Details
OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier does not perform permission checks in several HTTP endpoints.
This allows attackers with Overall/Read permission to connect to a previously configured Octoperf server using attacker-specified credentials.
Additionally, these endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
OctoPerf Load Testing Plugin Plugin 4.5.3 requires POST requests and the appropriate permissions for the affected HTTP endpoints.
Affected Packages
Maven
org.jenkinsci.plugins:octoperf
Affected versions:
0
(fixed in 4.5.3)
Related CVEs
Key Information
5.0
/10
Dataset
Last updated: August 24, 2025 6:28 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.