Cross-Site Request Forgery in Jenkins MATLAB Plugin by Jenkins
CVE-2023-49655

8.8HIGH

Key Information:

Vendor
Jenkins
Status
Jenkins MATLAB Plugin
Vendor
CVE Published:
29 November 2023

Summary

A cross-site request forgery vulnerability exists in the Jenkins MATLAB Plugin, allowing malicious attackers to exploit the plugin. If successfully exploited, the vulnerability enables unauthorized parsing of XML files from the Jenkins controller file system, potentially exposing sensitive information or enabling further attacks. Users of Jenkins MATLAB Plugin versions 2.11.0 and earlier are urged to update to secure versions as recommended in the official Jenkins Security Advisory.

Affected Version(s)

Jenkins MATLAB Plugin 0 <= 2.11.0

References

https://www.jenkins.io/security/advisory/2023-11-29/#SECU...
vendor-advisory
http://www.openwall.com/lists/oss-security/2023/11/29/1

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.