Missing Permission Check in Jenkins Sumologic Publisher Plugin Vulnerability
CVE-2023-37959

6.5MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Sumologic Publisher Plugin
Vendor
CVE Published:
12 July 2023

Summary

A security flaw exists in the Jenkins Sumologic Publisher Plugin versions 2.2.1 and earlier due to a missing permission check. This vulnerability enables attackers with Overall/Read permission to establish connections to URLs specified by the attacker, potentially leading to unauthorized access. Users are advised to review the Jenkins Security Advisory and update to the latest version to mitigate this risk.

Affected Version(s)

Jenkins Sumologic Publisher Plugin 0 <= 2.2.1

References

https://www.jenkins.io/security/advisory/2023-07-12/#SECU...
vendor-advisory
http://www.openwall.com/lists/oss-security/2023/07/12/2

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.