CVE-2023-49674: CSRF
First published: Wed Nov 29 2023(Updated: )
A missing permission check in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Neuvector Vulnerability Scanner | <=1.22 | |
| maven/io.jenkins.plugins:neuvector-vulnerability-scanner | <2.2 | 2.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Jenkins NeuVector Vulnerability Scanner Plugin vulnerability?
The vulnerability ID for this Jenkins NeuVector Vulnerability Scanner Plugin vulnerability is CVE-2023-49674.
What is the severity level of CVE-2023-49674?
The severity level of CVE-2023-49674 is medium.
What is the affected software of CVE-2023-49674?
The affected software of CVE-2023-49674 is Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier.
How can an attacker exploit CVE-2023-49674?
An attacker with Overall/Read permission can exploit CVE-2023-49674 by connecting to an attacker-specified hostname and port using attacker-specified username and password in a connection test HTTP endpoint.
Is there a fix available for CVE-2023-49674?
Yes, there is a fix available for CVE-2023-49674. Update Jenkins NeuVector Vulnerability Scanner Plugin to version 2.2 or later.
- collector/nvd-api
- agent/references
- agent/author
- agent/type
- agent/severity
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-ph87-4x2g-6hp4
- alias/CVE-2023-49674
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/jenkins
- canonical/jenkins neuvector vulnerability scanner
- version/jenkins neuvector vulnerability scanner/1.22
- package-manager/maven