CVE-2023-32998

HighCVSS 8.8

Published: 16/05/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.50%

39th percentile - higher than 39% of all known CVEs

Summary

The AppSpider Plugin in Jenkins version 1.0.15 and earlier contains a CSRF vulnerability that allows attackers to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.

Risk Assessment

This vulnerability could lead to unauthorized access to the system, posing a serious threat to the organization's data security.

Recommendation

It is recommended to update the AppSpider Plugin to the latest version to mitigate the risk associated with this vulnerability.

Other vulnerabilities in Jenkins AppSpider Plugin

CVE-2023-32999Medium
A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.

Original NVD description (English source)

A cross-site request forgery (CSRF) vulnerability in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS