CVE-2023-50767
mediumpriority · track · 22OT risk · elevatedEPSS 0.004 · 37 %ileDEEUUSEPSS · scored 2026-10-23
Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.1
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (22)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2023-3152Jenkins Plugins: Mehrere SchwachstellenDeutsch2023-12-13csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in verschiedenen Jenkins Plugins ausnutzen, um einen CSRF-Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder Dateien zu manipulieren.
- GHSA-9vrm-747r-668vJenkins Nexus Platform Plugin missing permission check2023-12-13ghsa · osvUS
Jenkins Nexus Platform Plugin 3.18.0-03 and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML. Additionally, the plugin does not configure its XML parser to prevent XML external entity (XXE) attacks, so attackers can have Jenkins parse a crafted XML response that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability. Nexus Platform Plugin 3.18.1-01 configures its XML parser to prevent XML external entity (XXE) attacks. Additionally, POST requests and Overall/Administer permission are required for the affected HTTP endpoints.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2023/12/13/4cnnvd
- https://cxsecurity.com/cveshow/CVE-2023-50767/cnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.7478cnnvd
- https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3204cnnvd
- http://www.openwall.com/lists/oss-security/2023/12/13/4enisa_euvd
- https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3204enisa_euvd
- http://www.openwall.com/lists/oss-security/2023/12/13/4Mailing Listnvd
- https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3204Vendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan