TI-2023-16186 Aliases CVE-2023-32998 GHSA-vgfw-766v-7q82

Cross-site request forgery in Jenkins AppSpider Plugin

MEDIUM 41CWE-352Published 2023-05-16 · Updated 2025-01-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

A cross-site request forgery (CSRF) vulnerability in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00502 43rd percentileScored 2026-11-07

Fix Fixed com.rapid7:jenkinsci-appspider-plugin (Maven): 1.0.16

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Jenkins	Jenkins AppSpider Plugin	up to 1.0.15	—	No fix listed	CNA
—	com.rapid7:jenkinsci-appspider-plugin (Maven)	before 1.0.16	1.0.16	Patch available	GHSA-vgfw-766v-7q82

Jenkins AppSpider Plugin VendorJenkins Affected up to 1.0.15 Fixed in — No fix listed CNA
com.rapid7:jenkinsci-appspider-plugin (Maven) Vendor— Affected before 1.0.16 Fixed in 1.0.16 Patch available GHSA-vgfw-766v-7q82

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jenkins:appspider::::::jenkins::*	up to 1.0.15	Vulnerable	Jenkins

cpe:2.3:a:jenkins:appspider:*:*:*:*:*:jenkins:*:* Versions up to 1.0.15 Vulnerable ·Jenkins

Remediation

Fix · GHSA-vgfw-766v-7q82 com.rapid7:jenkinsci-appspider-plugin (Maven) Fixed in 1.0.16 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2023-05-16
Jenkins AppSpider Plugin — Jenkins Security Advisory 2023-05-16
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2023-16187 Incorrect default permissions in Jenkins AppSpider PluginPriority LOW 21
Show all 2 records → Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-32998
2026-10-03 Alias added: GHSA-vgfw-766v-7q82

References

Advisory 2

Other 1

https://github.com/jenkinsci/appspider-build-scanner-plugin

TI-2020-02191 Insufficiently protected credentials in Jenkins AppSpider Plugin CVSS 3.1MEDIUM 5.5
TI-2023-16187 Incorrect default permissions in Jenkins AppSpider Plugin CVSS 3.1MEDIUM 4.3
TI-2024-18733 Missing authorization in Jenkins AppSpider Plugin CVSS 3.1MEDIUM 4.3
TI-2026-36182 Improper privilege management in Jenkins AppSpider Plugin CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences