Description
Jenkins OctoPerf Load Testing Plugin Plugin 4.5.1 and earlier does not perform a permission check in a connection test HTTP endpoint, allowing attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Published: 2023-03-23
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2023-1334 Jenkins OctoPerf Load Testing Plugin Plugin 4.5.1 and earlier does not perform a permission check in a connection test HTTP endpoint, allowing attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Github GHSA Github GHSA GHSA-j9h4-p6p7-8652 Jenkins OctoPerf Load Testing Plugin vulnerable to credential capture
History

Tue, 25 Feb 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Jenkins Octoperf Load Testing
cve-icon MITRE

Status: PUBLISHED

Assigner: jenkins

Published:

Updated: 2025-02-25T20:08:41.612Z

Reserved: 2023-03-20T19:59:08.756Z

Link: CVE-2023-28672

cve-icon Vulnrichment

Updated: 2024-08-02T13:43:23.635Z

cve-icon NVD

Status : Modified

Published: 2023-04-02T21:15:08.943

Modified: 2025-02-25T21:15:14.360

Link: CVE-2023-28672

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses