Jenkins Octoperf Load Testing vulnerabilities

5 CVEs affecting Jenkins Octoperf Load Testing, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-28675, published 2023-04-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-28672, published 2023-04-02. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Jenkins OctoPerf Load Testing Plugin Plugin 4.5.1 and earlier does not perform a permission check in a connection test HTTP endpoint, allowing attackers with Overall/Read permission to connect to an…
CVE-2023-28675, published 2023-04-02. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf server using attacker-specified credentials.
CVE-2023-28673, published 2023-04-02. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2023-28674, published 2023-04-02. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf server using…
CVE-2023-28671, published 2023-04-02. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified…