CVE-2023-40341: CSRF
First published: Wed Aug 16 2023(Updated: )
A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.27.5 and earlier allows attackers to connect to an attacker-specified URL, capturing GitHub credentials associated with an attacker-specified job.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Blue Ocean | <=1.27.5 | |
| maven/io.jenkins.blueocean:blueocean | <1.27.5.1 | 1.27.5.1 |
| redhat/Blue Ocean Plugin | <1.27.5.1 | 1.27.5.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2023/08/16/3
- https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-3116
- https://nvd.nist.gov/vuln/detail/CVE-2023-40341
- https://github.com/advisories/GHSA-g4pq-p927-7pgg (Advisory)
- https://access.redhat.com/errata/RHSA-2024:0777
- https://access.redhat.com/errata/RHSA-2024:0778
- https://bugzilla.redhat.com/show_bug.cgi?id=2232422
Frequently Asked Questions
What is the vulnerability ID for this Jenkins Blue Ocean Plugin vulnerability?
The vulnerability ID for this Jenkins Blue Ocean Plugin vulnerability is CVE-2023-40341.
What is the severity level of CVE-2023-40341?
The severity level of CVE-2023-40341 is high with a CVSS score of 8.8.
How does the CSRF vulnerability in Jenkins Blue Ocean Plugin occur?
The CSRF vulnerability in Jenkins Blue Ocean Plugin occurs due to not requiring POST requests for an HTTP endpoint.
What is the impact of the CSRF vulnerability in Jenkins Blue Ocean Plugin?
The CSRF vulnerability in Jenkins Blue Ocean Plugin allows attackers to connect to an attacker-specified URL and capture GitHub credentials.
How can I fix the CSRF vulnerability in Jenkins Blue Ocean Plugin?
To fix the CSRF vulnerability in Jenkins Blue Ocean Plugin, you should upgrade to version 1.27.5.1 or later.
- collector/nvd-api
- collector/nvd-index
- collector/nvd-cve
- collector/github-advisory-latest
- alias/GHSA-g4pq-p927-7pgg
- alias/CVE-2023-40341
- collector/github-advisory
- agent/first-publish-date
- agent/type
- agent/weakness
- agent/author
- agent/severity
- agent/softwarecombine
- agent/description
- agent/event
- agent/references
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/trending
- agent/tags
- agent/source
- vendor/jenkins
- canonical/jenkins blue ocean
- version/jenkins blue ocean/1.27.5
- package-manager/maven
- package-manager/redhat