CVE-2023-37962

HighCVSS 8.8

Published: 12/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

34th percentile - higher than 34% of all known CVEs

Summary

The Jenkins Benchmark Evaluator Plugin version 1.0.1 and earlier has a CSRF vulnerability that allows attackers to connect to an attacker-specified URL and check for the existence of directories and `.csv` and `.ycsb` files on the Jenkins controller file system.

Risk Assessment

This vulnerability may lead to the exposure of sensitive information about the file system structure and files on the Jenkins server, increasing the risk of further attacks.

Recommendation

It is recommended to update the plugin to the latest version to mitigate the risks associated with this vulnerability.

Other vulnerabilities in Jenkins Benchmark Evaluator Plugin

CVE-2023-37963Medium
A missing permission check in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, `.csv`, and `.ycsb` files on the Jenkins controller file system.

Original NVD description (English source)

A cross-site request forgery (CSRF) vulnerability in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers to connect to an attacker-specified URL and to check for the existence of directories, `.csv`, and `.ycsb` files on the Jenkins controller file system.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS