CVE-2023-2631: CSRF vulnerability and missing permission checks in Code Dx Plugin
A missing permission check in Jenkins Code Dx Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
Other sources
Jenkins Code Dx Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL.
Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Code Dx Plugin 4.0.0 requires POST requests and the appropriate permissions for the affected HTTP endpoints.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-2631?
CVE-2023-2631 is considered a critical severity vulnerability due to its potential to allow unauthorized access to specified URLs.
How do I fix CVE-2023-2631?
To fix CVE-2023-2631, upgrade the Jenkins Code Dx Plugin to version 4.0.0 or later.
What are the affected versions for CVE-2023-2631?
CVE-2023-2631 affects Jenkins Code Dx Plugin versions 3.1.0 and earlier.
What type of attack is associated with CVE-2023-2631?
CVE-2023-2631 allows attackers with Overall/Read permission to connect to an attacker-specified URL, which can lead to further exploitation.
Where can I find more details about CVE-2023-2631?
More details about CVE-2023-2631 can typically be found in security advisories related to Jenkins and the Code Dx Plugin.