CVE-2023-40348 is a medium-severity information disclosure vulnerability affecting the Jenkins Gogs Plugin versions 1.0.15 and earlier. Unauthenticated attackers can leverage a flaw in the webhook endpoint to determine the existence of jobs on the Jenkins instance. The vulnerability has a CVSS score of 5.3, indicating a low impact on confidentiality with no integrity or availability impact, and requires no user interaction or privileges. There is currently no public exploit code available (Metasploit, Nuclei, ExploitDB), nor is there evidence of active exploitation, and it has received minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.0.15CPE matchmatch criteria | cpe:2.3:a:jenkins:gogs:*:*:*:*:*:jenkins:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.