CVE-2023-40349

Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds of jobs.

Score

CVSS 3.1 5.3 Medium

Status

Modified - jenkinsci-cert@googlegroups.com

Published

2023-08-16

Last modified

2024-10-08

Weaknesses

CWE-665

Affected products

• Gogs (Jenkins)
• Jenkins Gogs Plugin (Jenkins Project)

References

• http://www.openwall.com/lists/oss-security/2023/08/16/3
• https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-2894