CVE-2023-40349

EPSS 0.12%
Veröffentlicht 16.08.2023 15:15:12
Zuletzt bearbeitet 21.11.2024 08:19:16
Quelle jenkinsci-cert@googlegroups.co
Teams Watchlist Login
Unerledigt Login

Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds of jobs.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 5

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Jenkins ≫ Gogs SwPlatformjenkins Version <= 1.0.15

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.12%	0.309

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE-665 Improper Initialization

The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

http://www.openwall.com/lists/oss-security/2023/08/16/3

Third Party Advisory

Mailing List

https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-2894

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2023-40349

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-40349

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-40349

EUVD