GHSA-wgvx-9rh5-4g4m

Source

https://github.com/advisories/GHSA-wgvx-9rh5-4g4m

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-wgvx-9rh5-4g4m/GHSA-wgvx-9rh5-4g4m.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-wgvx-9rh5-4g4m

Aliases

CVE-2023-37962

Published

2023-07-12T18:30:39Z

Modified

2024-02-16T08:14:08.953489Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Jenkins Benchmark Evaluator Plugin vulnerable to cross-site request forgery

Details

Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, .csv, and .ycsb files on the Jenkins controller file system.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Database specific

{
    "nvd_published_at": "2023-07-12T16:15:14Z",
    "cwe_ids": [
        "CWE-352"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-12T22:30:15Z"
}

References

Affected packages

Maven / io.jenkins.plugins:benchmark-evaluator

Package

Name: io.jenkins.plugins:benchmark-evaluator; View open source insights on deps.dev
Purl: pkg:maven/io.jenkins.plugins/benchmark-evaluator

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.0.1

Affected versions

1.*

1.0.0

1.0.1