GHSA-5g87-44p9-v4j7

Suggest an improvement
Source
https://github.com/advisories/GHSA-5g87-44p9-v4j7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-5g87-44p9-v4j7/GHSA-5g87-44p9-v4j7.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-5g87-44p9-v4j7
Aliases
  • CVE-2023-37963
Published
2023-07-12T18:30:39Z
Modified
2024-02-16T08:12:50.710639Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Jenkins Benchmark Evaluator Plugin missing permission check
Details

Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, .csv, and .ycsb files on the Jenkins controller file system.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

References

Affected packages

Maven / io.jenkins.plugins:benchmark-evaluator

Package

Name
io.jenkins.plugins:benchmark-evaluator
View open source insights on deps.dev
Purl
pkg:maven/io.jenkins.plugins/benchmark-evaluator

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
1.0.1

Affected versions

1.*

1.0.0
1.0.1