CVE-2023-40349: Medium severity jenkins vulnerability
Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds of jobs.
Other sources
Jenkins Gogs Plugin provides a webhook endpoint at /gogs-webhook that can be used to trigger builds of jobs. In Gogs Plugin 1.0.15 and earlier, an option to specify a Gogs secret for this webhook is provided, but not enabled by default.
This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified job name.
Additionally, the output of the webhook endpoint includes whether a job corresponding to the attacker-specified job name exists, even if the attacker has no permission to access it.
As of publication of this advisory, there is no fix.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-40349?
CVE-2023-40349 is a vulnerability in Jenkins Gogs Plugin 1.0.15 and earlier that allows unauthenticated attackers to trigger builds of jobs.
What is the severity of CVE-2023-40349?
The severity of CVE-2023-40349 is medium with a CVSS score of 6.5.
How does CVE-2023-40349 affect Jenkins Gogs Plugin?
CVE-2023-40349 affects Jenkins Gogs Plugin 1.0.15 and earlier versions by improperly initializing an option that secures its webhook endpoint.
How can the CVE-2023-40349 vulnerability be exploited?
The CVE-2023-40349 vulnerability can be exploited by unauthenticated attackers to trigger builds of jobs using the Gogs Plugin webhook endpoint.
How can the CVE-2023-40349 vulnerability be fixed?
To fix the CVE-2023-40349 vulnerability, update Jenkins Gogs Plugin to version 1.0.16 or later.