PT-2023-21892 · Jenkins · Jenkins Octoperf Load Testing Plugin+1

Yaroslav Afenkin · Published 2023-03-23 · Updated 2023-04-07 · CVE-2023-28671

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins OctoPerf Load Testing Plugin Plugin versions 4.5.0 and earlier

Description A cross-site request forgery (CSRF) issue allows attackers to connect to a specified URL using attacker-specified credentials IDs, potentially capturing credentials stored in Jenkins. The vulnerability is due to the plugin not requiring POST requests for a connection test HTTP endpoint.

Recommendations For Jenkins OctoPerf Load Testing Plugin Plugin versions 4.5.0 and earlier, update to version 4.5.1 or later, which requires POST requests for the affected connection test HTTP endpoint.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-28671

GHSA-WQ3W-3RXH-VCXX

Affected Products

Jenkins

Jenkins Octoperf Load Testing Plugin

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-28671 · Security Note
• https://jenkins.io/security/advisory/2023-03-21/#SECURITY-3067%20(1) · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28671 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wq3w-3rxh-vcxx · Vendor Advisory