Description

A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf server using attacker-specified credentials.

Remediation

References

https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-3067%20(4)

Related Vulnerabilities

CVE-2017-15682 Vulnerability in maven package org.craftercms:crafter-studio

CVE-2019-20343 Vulnerability in maven package org.codehaus.mojo:exec-maven-plugin

CVE-2023-43501 Vulnerability in maven package com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer

CVE-2022-46907 Vulnerability in maven package org.apache.jspwiki:jspwiki-war

CVE-2017-1000394 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

Severity

Critical

Classification

CWE-352 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Vendor Advisory