CVE-2023-40348: Infoleak
Jenkins Gogs Plugin provides a webhook endpoint at /gogs-webhook that can be used to trigger builds of jobs. In Gogs Plugin 1.0.15 and earlier, an option to specify a Gogs secret for this webhook is provided, but not enabled by default.
This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified job name.
Additionally, the output of the webhook endpoint includes whether a job corresponding to the attacker-specified job name exists, even if the attacker has no permission to access it.
As of publication of this advisory, there is no fix.
Other sources
The webhook endpoint in Jenkins Gogs Plugin 1.0.15 and earlier provides unauthenticated attackers information about the existence of jobs in its output.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-40348?
CVE-2023-40348 is a vulnerability in Jenkins Gogs Plugin 1.0.15 and earlier that allows unauthenticated attackers to trigger builds of jobs by exploiting the unsecured webhook endpoint.
How severe is CVE-2023-40348?
CVE-2023-40348 has a severity rating of 6.5, which is classified as medium.
What software is affected by CVE-2023-40348?
Jenkins Gogs Plugin 1.0.15 and earlier versions are affected by CVE-2023-40348.
How can an attacker exploit CVE-2023-40348?
An attacker can exploit CVE-2023-40348 by sending requests to the unsecured webhook endpoint in Jenkins Gogs Plugin, triggering builds of jobs without authentication.
How can I fix CVE-2023-40348?
To fix CVE-2023-40348, upgrade to a version of Jenkins Gogs Plugin that is not affected by the vulnerability.