CVE-2023-40349

EPSS 0.12%
Published 16.08.2023 15:15:12
Last modified 21.11.2024 08:19:16
Source jenkinsci-cert@googlegroups.co
Teams watchlist Login
Open Login

Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds of jobs.

Affected products Warnungen 0 Metrics 2 CWE 1 References 5

Data is provided by the National Vulnerability Database (NVD)

Jenkins ≫ Gogs SwPlatformjenkins Version <= 1.0.15

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.12%	0.309

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE-665 Improper Initialization

The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

http://www.openwall.com/lists/oss-security/2023/08/16/3

Third Party Advisory

Mailing List

https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-2894

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2023-40349

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-40349

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-40349

EUVD