GHSA-j9h4-p6p7-8652MediumCVSS 6.5

Jenkins OctoPerf Load Testing Plugin vulnerable to credential capture

Published
April 2, 2023
Last Modified
April 7, 2023

🔗 CVE IDs covered (1)

CVE-2023-28672 →

📋 Description

OctoPerf Load Testing Plugin Plugin 4.5.1 and earlier does not perform a permission check in a connection test HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

OctoPerf Load Testing Plugin Plugin 4.5.2 properly performs a permission check when accessing the affected connection test HTTP endpoint.

🎯 Affected products1

  • maven/org.jenkinsci.plugins:octoperf:< 4.5.2

🔗 References (3)