Jenkins Gogs Plugin Vulnerability Exposes Webhook Endpoint to Attackers

CVE-2023-40349

What is CVE-2023-40349?

The Jenkins Gogs Plugin, version 1.0.15 and earlier, suffers from improper initialization of security options for its webhook endpoint. This misconfiguration enables unauthorized attackers to trigger job builds without authentication, posing a significant security risk. To mitigate this vulnerability, users are advised to upgrade to the latest version of the plugin and review their webhook security configurations. For detailed guidance, refer to the Jenkins Security Advisory.

References