Lucene search

PerforceVULNRICHMENT:CVE-2024-3825

HistoryApr 17, 2024 - 3:03 p.m.

CVE-2024-3825 CSRF in BlazeMeter Jenkins plugin

2024-04-1715:03:14

CWE-352

Perforce

github.com

cve-2024-3825

csrf

blazemeter jenkins plugin

credential enumeration

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

6.6

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Versions of the BlazeMeter Jenkins plugin prior to 4.22 contain a flaw which results in credential enumeration

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:jenkins:blazemeter_plugin:4.22:*:*:*:*:*:*:*"
    ],
    "vendor": "jenkins",
    "product": "blazemeter_plugin",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "4.22",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

github.com/Blazemeter/blazemeter-jenkins-plugin/commit/11ec94f68136a0612ae1b37b5370053132cb2528

portal.perforce.com/s/detail/a91PA000001STsvYAG

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

6.6

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2024-3825