Description
A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Published: 2023-03-23
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2023-1411 A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Github GHSA Github GHSA GHSA-wq3w-3rxh-vcxx Jenkins OctoPerf Load Testing Plugin vulnerable to Cross-site Request Forgery
History

Tue, 25 Feb 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Jenkins Octoperf Load Testing
cve-icon MITRE

Status: PUBLISHED

Assigner: jenkins

Published:

Updated: 2025-02-25T20:10:22.258Z

Reserved: 2023-03-20T19:59:08.756Z

Link: CVE-2023-28671

cve-icon Vulnrichment

Updated: 2024-08-02T13:43:23.740Z

cve-icon NVD

Status : Modified

Published: 2023-04-02T21:15:08.887

Modified: 2025-02-25T21:15:14.190

Link: CVE-2023-28671

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses