CVE-2023-41938

2023-09-0613:15:10

CWE-352

[email protected]

web.nvd.nist.gov

cve

2023

41938

jenkins

ivy plugin

csrf

vulnerability

deletion

disabled modules

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

0.0005 Low

EPSS

Percentile

18.0%

JSON

A cross-site request forgery (CSRF) vulnerability in Jenkins Ivy Plugin 2.5 and earlier allows attackers to delete disabled modules.

Affected configurations

NVD

Node

jenkinsivyRange≤2.5jenkins

CPENameOperatorVersion
jenkins:ivyjenkins ivyle2.5

CPE	Name	Operator	Version
jenkins:ivy	jenkins ivy	le	2.5

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "Jenkins Ivy Plugin",
    "vendor": "Jenkins Project",
    "versions": [
      {
        "lessThanOrEqual": "2.5",
        "status": "affected",
        "version": "0",
        "versionType": "maven"
      }
    ]
  }
]