exploitDog

CVE-2023-40348

Опубликовано: 16 авг. 2023

Источник: nvd

CVSS3: 5.3

EPSS Низкий

Описание

The webhook endpoint in Jenkins Gogs Plugin 1.0.15 and earlier provides unauthenticated attackers information about the existence of jobs in its output.

Ссылки

http://www.openwall.com/lists/oss-security/2023/08/16/3
Mailing List
Third Party Advisory
https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-2894
Vendor Advisory
http://www.openwall.com/lists/oss-security/2023/08/16/3
Mailing List
Third Party Advisory
https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-2894
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jenkins:gogs:*:*:*:*:*:jenkins:*:*

Версия до 1.0.15 (включая)

EPSS

Процентиль: 41%

0.00191

Низкий

5.3 Medium

CVSS3

Дефекты

NVD-CWE-noinfo

CWE-200

Связанные уязвимости

GHSA-qxwc-wchr-5h29

CVSS3: 6.5

github

больше 2 лет назад

Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure

EPSS

Процентиль: 41%

0.00191

Низкий

5.3 Medium

CVSS3

Дефекты

NVD-CWE-noinfo

CWE-200