CVE-2023-32999
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.
Risk Assessment
Attackers can gain access to sensitive data by sending unauthorized requests, potentially leading to a security breach.
Recommendation
It is recommended to update the AppSpider plugin to the latest version to eliminate the permission check vulnerability and restrict access to the plugin to trusted users.
Original NVD description (English source)
A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.