CVE-2023-40349

Summary

Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds of jobs.

Affected Software

Weaknesses

ADP Enrichment

CVE Program Container

Additional References

• https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-2894
• http://www.openwall.com/lists/oss-security/2023/08/16/3

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-2894
• http://www.openwall.com/lists/oss-security/2023/08/16/3

• ←Previous
• Next→