CSRF Vulnerability in Jenkins Sumologic Publisher Plugin Affecting Multiple Versions
CVE-2023-37958

8.8HIGH

Key Information:

Vendor
Jenkins
Status
Jenkins Sumologic Publisher Plugin
Vendor
CVE Published:
12 July 2023

Summary

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Jenkins Sumologic Publisher Plugin (versions 2.2.1 and earlier), enabling attackers to manipulate requests and potentially connect to unauthorized URLs specified by the attacker. This vulnerability poses a significant security risk if exploited, as it may allow malicious actions to be performed in the context of an authenticated user.

Affected Version(s)

Jenkins Sumologic Publisher Plugin 0 <= 2.2.1

References

https://www.jenkins.io/security/advisory/2023-07-12/#SECU...
vendor-advisory
http://www.openwall.com/lists/oss-security/2023/07/12/2

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.