CVE-2023-49674: CSRF
A missing permission check in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password.
Other sources
Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier does not perform a permission check in a connection test HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password. Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
NeuVector Vulnerability Scanner Plugin 2.2 requires POST requests and Overall/Administer permission for the affected HTTP endpoint.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Jenkins NeuVector Vulnerability Scanner Plugin vulnerability?
The vulnerability ID for this Jenkins NeuVector Vulnerability Scanner Plugin vulnerability is CVE-2023-49674.
What is the severity level of CVE-2023-49674?
The severity level of CVE-2023-49674 is medium.
What is the affected software of CVE-2023-49674?
The affected software of CVE-2023-49674 is Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier.
How can an attacker exploit CVE-2023-49674?
An attacker with Overall/Read permission can exploit CVE-2023-49674 by connecting to an attacker-specified hostname and port using attacker-specified username and password in a connection test HTTP endpoint.
Is there a fix available for CVE-2023-49674?
Yes, there is a fix available for CVE-2023-49674. Update Jenkins NeuVector Vulnerability Scanner Plugin to version 2.2 or later.