GitHub Advisoryadvisory · Maven

GHSA-qxwc-wchr-5h29 Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure

MEDIUM Published 2023-08-16 Modified 2023-08-16 Official page ↗
Aliases
CVE-2023-40348
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:gogs-webhook
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-200
Reviewed
2023-08-16

Affected packages

• Maven org.jenkins-ci.plugins:gogs-webhook: <= 1.0.15 (no fix yet)

Description

Jenkins Gogs Plugin provides a webhook endpoint at `/gogs-webhook` that can be used to trigger builds of jobs. In Gogs Plugin 1.0.15 and earlier, an option to specify a Gogs secret for this webhook is provided, but not enabled by default. This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified job name. Additionally, the output of the webhook endpoint includes whether a job corresponding to the attacker-specified job name exists, even if the attacker has no permission to access it. As of publication of this advisory, there is no fix.

Related

Alias · CVE (1)

  • CVE-2023-40348 The webhook endpoint in Jenkins Gogs Plugin 1.0.15 and earlier provides unauthenticated attackers information about the existence of jobs… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References