Cross-Site Request Forgery in Jenkins Benchmark Evaluator Plugin
CVE-2023-37962

8.8HIGH

Key Information:

Vendor
Jenkins
Status
Jenkins Benchmark Evaluator Plugin
Vendor
CVE Published:
12 July 2023

Summary

A CSRF vulnerability in the Jenkins Benchmark Evaluator Plugin allows attackers to perform unauthorized actions by sending crafted requests. This flaw enables them to connect to arbitrary URLs and to verify the existence of directories and specific file types, such as .csv and .ycsb, within the Jenkins controller's file system. By exploiting this vulnerability, an attacker could potentially expose sensitive information and compromise the integrity of the Jenkins environment.

Affected Version(s)

Jenkins Benchmark Evaluator Plugin 0 <= 1.0.1

References

https://www.jenkins.io/security/advisory/2023-07-12/#SECU...
vendor-advisory
http://www.openwall.com/lists/oss-security/2023/07/12/2

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.