github - ghsa-rc33-44qp-vpvq

ghsa-rc33-44qp-vpvq

Vulnerability from github

Published

2023-08-16 15:30

Modified

2023-08-16 21:04

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Summary

Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure

Details

Jenkins Gogs Plugin provides a webhook endpoint at /gogs-webhook that can be used to trigger builds of jobs. In Gogs Plugin 1.0.15 and earlier, an option to specify a Gogs secret for this webhook is provided, but not enabled by default.

This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified job name.

Additionally, the output of the webhook endpoint includes whether a job corresponding to the attacker-specified job name exists, even if the attacker has no permission to access it.

As of publication of this advisory, there is no fix.

Show details on source website

JSON

To clipboard

{
   affected: [
      {
         package: {
            ecosystem: "Maven",
            name: "org.jenkins-ci.plugins:gogs-webhook",
         },
         ranges: [
            {
               events: [
                  {
                     introduced: "0",
                  },
                  {
                     last_affected: "1.0.15",
                  },
               ],
               type: "ECOSYSTEM",
            },
         ],
      },
   ],
   aliases: [
      "CVE-2023-40349",
   ],
   database_specific: {
      cwe_ids: [
         "CWE-665",
      ],
      github_reviewed: true,
      github_reviewed_at: "2023-08-16T21:04:57Z",
      nvd_published_at: "2023-08-16T15:15:12Z",
      severity: "MODERATE",
   },
   details: "Jenkins Gogs Plugin provides a webhook endpoint at /gogs-webhook that can be used to trigger builds of jobs. In Gogs Plugin 1.0.15 and earlier, an option to specify a Gogs secret for this webhook is provided, but not enabled by default.\n\nThis allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified job name.\n\nAdditionally, the output of the webhook endpoint includes whether a job corresponding to the attacker-specified job name exists, even if the attacker has no permission to access it.\n\nAs of publication of this advisory, there is no fix.",
   id: "GHSA-rc33-44qp-vpvq",
   modified: "2023-08-16T21:04:57Z",
   published: "2023-08-16T15:30:18Z",
   references: [
      {
         type: "ADVISORY",
         url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40349",
      },
      {
         type: "WEB",
         url: "https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-2894",
      },
      {
         type: "WEB",
         url: "http://www.openwall.com/lists/oss-security/2023/08/16/3",
      },
   ],
   schema_version: "1.4.0",
   severity: [
      {
         score: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
         type: "CVSS_V3",
      },
   ],
   summary: "Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure",
}

cve-2023-40349

Vulnerability from cvelistv5

Published

2023-08-16 14:32

Modified

2024-10-08 18:22

Severity ?

Summary

Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds of jobs.

References

▼	URL	Tags
	https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-2894	vendor-advisory
	http://www.openwall.com/lists/oss-security/2023/08/16/3

Impacted products

	Vendor	Product	Version
	Jenkins Project	Jenkins Gogs Plugin	Version: 0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T18:31:53.589Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "Jenkins Security Advisory 2023-08-16",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-2894",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2023/08/16/3",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-40349",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-10-08T18:22:22.094457Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-10-08T18:22:33.595Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "Jenkins Gogs Plugin",
               vendor: "Jenkins Project",
               versions: [
                  {
                     lessThanOrEqual: "1.0.15",
                     status: "affected",
                     version: "0",
                     versionType: "maven",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds of jobs.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-10-24T12:51:35.479Z",
            orgId: "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
            shortName: "jenkins",
         },
         references: [
            {
               name: "Jenkins Security Advisory 2023-08-16",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-2894",
            },
            {
               url: "http://www.openwall.com/lists/oss-security/2023/08/16/3",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
      assignerShortName: "jenkins",
      cveId: "CVE-2023-40349",
      datePublished: "2023-08-16T14:32:57.708Z",
      dateReserved: "2023-08-14T16:02:56.436Z",
      dateUpdated: "2024-10-08T18:22:33.595Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted