Cross-Site Request Forgery Vulnerability in Jenkins PaaSLane Estimate Plugin
CVE-2023-50778

8.8HIGH

Key Information:

Vendor
Jenkins
Status
Jenkins PaaSLane Estimate Plugin
Vendor
CVE Published:
13 December 2023

Summary

A cross-site request forgery (CSRF) vulnerability exists in the Jenkins PaaSLane Estimate Plugin version 1.0.4 and earlier. This flaw permits attackers to connect to a URL specified by them, utilizing an attacker-defined token, which could lead to unauthorized actions being executed on behalf of unsuspecting users.

Affected Version(s)

Jenkins PaaSLane Estimate Plugin 0 <= 1.0.4

References

https://www.jenkins.io/security/advisory/2023-12-13/#SECU...
vendor-advisory
http://www.openwall.com/lists/oss-security/2023/12/13/4

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.