CVE Catalog
CVE-2023-40349
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk0.58%
43th percentile - higher than 43% of all known CVEs
Summary
Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds of jobs.
Risk Assessment
Attackers can trigger job builds without authorization, potentially leading to unauthorized changes in the system and security breaches.
Recommendation
It is recommended to update the Gogs plugin to the latest version to improve the security of the webhook endpoint.
Original NVD description (English source)
Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds of jobs.