Medium · 4.3 CVE-2023-28673 EUVD-2023-1354GHSA-mjg3-2v66-p34j

Jenkins OctoPerf Load Testing Plugin missing permission check allows for ID enumeration

Published Mar 23, 2023 · Updated Aug 2, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins OctoPerf Load Testing Plugin Plugin Package: org.jenkinsci.plugins:octoperf Category: Web / CMS Ecosystem: Maven

Description

A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

Affected products

Vendor	Product	Affected	Fixed
Jenkins Project	Jenkins OctoPerf Load Testing Plugin Plugin	≤ 4.5.2	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jenkinsci.plugins:octoperf	< 4.5.3	4.5.3	GHSA-mjg3-2v66-p34j

Advisories 1

WID-SEC-2023-0704 Jenkins Plugins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 21, 2023

References

Jenkins Security Advisory 2023-03-21 vendor-advisory