CVE-2023-40348

CVE-2023-40348 affects the Jenkins Gogs Plugin (versions up to 1.0.15). The webhook endpoint at /gogs-webhook can be reached by unauthenticated attackers and discloses whether a specific job exists, even if the attacker lacks permission to access that job. The root cause is an information-disclos...

CVE-2023-40349

The CVE-2023-40349 entry concerns Jenkins Gogs Plugin (versions 1.0.15 and earlier). The vulnerability arises from improper initialization of the option intended to secure the webhook endpoint, allowing unauthenticated attackers to trigger builds of jobs. The advisory notes that the webhook endpo...

CVE-2023-46657

The CVE concerns Jenkins Gogs Plugin

CVE-2019-10348

CVE-2019-10348 - Jenkins Gogs Plugin: The vulnerability arises from storing credentials in plaintext in job config.xml on the Jenkins master, enabling disclosure to users with Extended Read or anyone with master filesystem access. The NVD entry notes a CVSS v3.1 base score of 8.8 (HIGH). Public a...