CVE-2026-48923
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation. Attackers with Overall/Read permission can connect to an attacker-specified URL.
Risk Assessment
An attacker with low privileges can force the Jenkins server to connect to an arbitrary URL, enabling SSRF attacks and internal network scanning.
Recommendation
Update the Jenkins AppSpider Plugin to a version newer than 1.0.17 or disable it if not in use.
Other vulnerabilities in Jenkins AppSpider Plugin
See all- CVE-2023-32999Medium
A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.
- CVE-2023-32998High
The AppSpider Plugin in Jenkins version 1.0.15 and earlier contains a CSRF vulnerability that allows attackers to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.
Original NVD description (English source)
Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to connect to an attacker-specified URL.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS