GHSA-cpc3-gm2x-mrvpMediumCVSS 4.3

Jenkins Tag Profiler Plugin missing permission check

Published
May 16, 2023
Last Modified
November 7, 2023

🔗 CVE IDs covered (1)

CVE-2023-33004 →

📋 Description

Jenkins Tag Profiler Plugin 0.2 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to reset profiler statistics.

Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix.

🎯 Affected products1

  • maven/org.jenkins-ci.plugins:tag-profiler:<= 0.2

🔗 References (3)