CVE-2023-37963
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A missing permission check in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, `.csv`, and `.ycsb` files on the Jenkins controller file system.
Risk Assessment
Attackers may gain access to sensitive information about the file structure on the Jenkins server, potentially leading to further attacks or data leaks.
Recommendation
It is recommended to update the Jenkins Benchmark Evaluator Plugin to the latest version to eliminate the permission check vulnerability.
Original NVD description (English source)
A missing permission check in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, `.csv`, and `.ycsb` files on the Jenkins controller file system.