Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Advisory: Jenkins OctoPerf Load Testing Plugin Plugin — Jenkins Security Advisory 2023-03-21 Clear all filters
TI-2023-13193 CVE-2023-28675 · GHSA-p3w6-3f7f-pm98

Missing authorization in Jenkins OctoPerf Load Testing Plugin Plugin

Priority LOW 20

A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf server using attacker-specified credentials.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00425 Published 2023-03-23 Fixed in 4.5.3 CWE-862
TI-2023-13192 CVE-2023-28674 · GHSA-x263-hp5c-p2rj

Cross-site request forgery in Jenkins OctoPerf Load Testing Plugin Plugin

Priority MEDIUM 40

A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf server using attacker-specified credentia…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00362 Published 2023-03-23 Fixed in 4.5.3 CWE-352
TI-2023-13191 CVE-2023-28673 · GHSA-mjg3-2v66-p34j

Missing authorization in Jenkins OctoPerf Load Testing Plugin Plugin

Priority LOW 20

A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00409 Published 2023-03-23 Fixed in 4.5.3 CWE-862
TI-2023-13190 CVE-2023-28672 · GHSA-j9h4-p6p7-8652

Missing authorization in Jenkins OctoPerf Load Testing Plugin Plugin

Priority LOW 29

Jenkins OctoPerf Load Testing Plugin Plugin 4.5.1 and earlier does not perform a permission check in a connection test HTTP endpoint, allowing attackers with Overall/Read permission to connect to an attacker-specified UR…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00509 Published 2023-03-23 Fixed in 4.5.2 CWE-862
TI-2023-13189 CVE-2023-28671 · GHSA-wq3w-3rxh-vcxx

Cross-site request forgery in Jenkins OctoPerf Load Testing Plugin Plugin

Priority LOW 20

A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtaine…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00361 Published 2023-03-23 Fixed in 4.5.1 CWE-352