Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS01Zzg3LTQ0cDktdjRqN84AA0qG

Jenkins Benchmark Evaluator Plugin missing permission check

Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, .csv, and .ycsb files on the Jenkins controller file system.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Permalink: https://github.com/advisories/GHSA-5g87-44p9-v4j7
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01Zzg3LTQ0cDktdjRqN84AA0qG
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 10 months ago
Updated: 6 months ago

CVSS Score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Identifiers: GHSA-5g87-44p9-v4j7, CVE-2023-37963
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-37963
• https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3119
• http://www.openwall.com/lists/oss-security/2023/07/12/2
• https://github.com/advisories/GHSA-5g87-44p9-v4j7

Blast Radius: 1.0

Affected Packages