Description

The webhook endpoint in Jenkins Gogs Plugin 1.0.15 and earlier provides unauthenticated attackers information about the existence of jobs in its output.

Remediation

References

https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-2894

http://www.openwall.com/lists/oss-security/2023/08/16/3

Related Vulnerabilities

CVE-2020-16013 Vulnerability in npm package electron

CVE-2019-12421 Vulnerability in maven package org.apache.nifi:nifi-web

CVE-2023-34238 Vulnerability in npm package gatsby

CVE-2017-5653 Vulnerability in maven package org.apache.cxf:cxf-rt-rs-security-xml

CVE-2015-8131 Vulnerability in npm package kibana

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Vendor Advisory Mailing List Third Party Advisory NVD-CWE-noinfo