CVE-2023-40348: Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure
Summary
CVE-2023-40348: Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure. Affects org.jenkins-ci.plugins:gogs-webhook versions < 1.0.15. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins Gogs Plugin is a Maven package that provides a webhook endpoint at /gogs-webhook for triggering builds of jobs. This plugin version 1.0.15 and earlier allows unauthenticated attackers to trigger builds of jobs by exploiting the unsafe default behavior. The plugin also discloses information about the existence of a job, even if the attacker has no permission to access it.
Vulnerability Detail
The vulnerability in Jenkins Gogs Plugin arises from the fact that the option to specify a Gogs secret for the webhook is not enabled by default. This allows attackers to trigger builds of jobs by specifying the job name. Furthermore, the output of the webhook endpoint reveals whether a job corresponding to the specified name exists, regardless of the attacker's access permissions. This vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No workaround is currently provided for this vulnerability.
Conclusion
The Jenkins Gogs Plugin is vulnerable to unsafe default behavior and information disclosure, allowing unauthenticated attackers to trigger builds of jobs and obtain job existence information. As of now, there is no fix available for this vulnerability. It is recommended to monitor the official Jenkins Gogs Plugin repository for updates and patches. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:gogs-webhook →
FAQ
This vulnerability allows unauthenticated attackers to trigger builds of jobs and obtain information about the existence of jobs, even if they do not have permission to access them.
No, there is currently no fix available for this vulnerability. It is advised to monitor the official Jenkins Gogs Plugin repository for any updates or patches addressing this issue.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
To protect your system, it is recommended to closely monitor the official Jenkins Gogs Plugin repository for any updates or patches addressing this vulnerability. Once a fix is released, apply it promptly to ensure the security of the plugin.
For more information about this vulnerability, you can refer to the official Jenkins Gogs Plugin repository or contact the Jenkins community for assistance.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:gogs-webhook.
