CVE-2023-32999
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.
Risk Assessment
Attackers can gain access to sensitive data by sending unauthorized requests, potentially leading to a security breach.
Recommendation
It is recommended to update the AppSpider plugin to the latest version to eliminate the permission check vulnerability and restrict access to the plugin to trusted users.
Other vulnerabilities in Jenkins AppSpider Plugin
See all- CVE-2026-48923Medium
Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation. Attackers with Overall/Read permission can connect to an attacker-specified URL.
- CVE-2023-32998High
The AppSpider Plugin in Jenkins version 1.0.15 and earlier contains a CSRF vulnerability that allows attackers to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.
Original NVD description (English source)
A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS