CVE-2023-32998: CSRF
A cross-site request forgery (CSRF) vulnerability in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.rapid7:jenkinsci-appspider-pluginto a version that resolves this vulnerability.Fixed in 1.0.16
Event History
Frequently Asked Questions
What is the severity of CVE-2023-32998?
CVE-2023-32998 is classified as a medium severity cross-site request forgery (CSRF) vulnerability.
How do I fix CVE-2023-32998?
To mitigate CVE-2023-32998, upgrade the Jenkins AppSpider Plugin to version 1.0.16 or later.
What impact does CVE-2023-32998 have on Jenkins users?
CVE-2023-32998 allows attackers to send unauthorized HTTP POST requests using an attacker-specified URL, potentially compromising user credentials.
Which versions of Jenkins AppSpider are affected by CVE-2023-32998?
Jenkins AppSpider Plugin versions 1.0.15 and earlier are affected by CVE-2023-32998.
Is CVE-2023-32998 a remote attack vector?
Yes, CVE-2023-32998 can be exploited remotely, enabling attackers to perform unauthorized actions if a user is tricked into visiting a malicious page.