mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-06-07 13:36:56 +00:00
91 lines
2.8 KiB
JSON
91 lines
2.8 KiB
JSON
{
|
|
"id": "CVE-2023-46658",
|
|
"sourceIdentifier": "jenkinsci-cert@googlegroups.com",
|
|
"published": "2023-10-25T18:17:40.307",
|
|
"lastModified": "2023-11-01T18:21:31.533",
|
|
"vulnStatus": "Analyzed",
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "Jenkins MSTeams Webhook Trigger Plugin 0.1.1 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token."
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "Jenkins MSTeams Webhook Trigger Plugin 0.1.1 y versiones anteriores utilizan una funci\u00f3n de comparaci\u00f3n de tiempo no constante al comprobar si el token de webhook proporcionado y el esperado son iguales, lo que potencialmente permite a los atacantes utilizar m\u00e9todos estad\u00edsticos para obtener un token de webhook v\u00e1lido."
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV31": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"cvssData": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "NONE",
|
|
"userInteraction": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "LOW",
|
|
"integrityImpact": "NONE",
|
|
"availabilityImpact": "NONE",
|
|
"baseScore": 5.3,
|
|
"baseSeverity": "MEDIUM"
|
|
},
|
|
"exploitabilityScore": 3.9,
|
|
"impactScore": 1.4
|
|
}
|
|
]
|
|
},
|
|
"weaknesses": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-697"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"configurations": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:jenkins:msteams_webhook_trigger:0.1.0:*:*:*:*:jenkins:*:*",
|
|
"matchCriteriaId": "45F57EA8-6ADF-4853-8E4E-0F98A62AE94D"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:jenkins:msteams_webhook_trigger:0.1.1:*:*:*:*:jenkins:*:*",
|
|
"matchCriteriaId": "4D000CE1-ADFB-48B1-9E4C-FDF151AE9D41"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "http://www.openwall.com/lists/oss-security/2023/10/25/2",
|
|
"source": "jenkinsci-cert@googlegroups.com",
|
|
"tags": [
|
|
"Mailing List"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://www.jenkins.io/security/advisory/2023-10-25/#SECURITY-2876",
|
|
"source": "jenkinsci-cert@googlegroups.com",
|
|
"tags": [
|
|
"Vendor Advisory"
|
|
]
|
|
}
|
|
]
|
|
} |