CVE-2023-50779

2023-12-1318:15:44

CWE-862

jenkins

web.nvd.nist.gov

cve-2023-50779

missing permission checks

jenkins

paaslane estimate plugin

security vulnerability

nvd

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

4.5

Confidence

High

EPSS

Percentile

13.3%

JSON

Missing permission checks in Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified token.

Affected configurations

Nvd

Node

jenkinspaaslane_estimateRange≤1.0.4jenkins

VendorProductVersionCPE
jenkinspaaslane_estimate*cpe:2.3:a:jenkins:paaslane_estimate:*:*:*:*:*:jenkins:*:*

Vendor	Product	Version	CPE
jenkins	paaslane_estimate	*	cpe:2.3:a:jenkins:paaslane_estimate::::::jenkins::*

CNA Affected

[
  {
    "vendor": "Jenkins Project",
    "product": "Jenkins PaaSLane Estimate Plugin",
    "versions": [
      {
        "version": "0",
        "versionType": "maven",
        "lessThanOrEqual": "1.0.4",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]