GHSA-5g87-44p9-v4j7

Source

https://github.com/advisories/GHSA-5g87-44p9-v4j7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-5g87-44p9-v4j7/GHSA-5g87-44p9-v4j7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5g87-44p9-v4j7

Aliases

CVE-2023-37963

Published

2023-07-12T18:30:39Z

Modified

2024-02-16T08:12:50.710639Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

Jenkins Benchmark Evaluator Plugin missing permission check

Details

Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, .csv, and .ycsb files on the Jenkins controller file system.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Database specific

{
    "nvd_published_at": "2023-07-12T16:15:14Z",
    "cwe_ids": [
        "CWE-862"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-12T22:30:05Z"
}

References

Affected packages

Maven / io.jenkins.plugins:benchmark-evaluator

Package

Name: io.jenkins.plugins:benchmark-evaluator; View open source insights on deps.dev
Purl: pkg:maven/io.jenkins.plugins/benchmark-evaluator

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.0.1

Affected versions

1.*

1.0.0

1.0.1