Not rated
CVE-2023-46657 Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided…
Description
Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins Gogs Plugin 1.0 | earliest → 1.0.15 | No fix stated |
Other CVEs of Jenkins Gogs Plugin
The 4 CVEs of Jenkins Gogs Plugin →
CVE-2023-40349
Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing…
Not rated
CVE-2023-40348
The webhook endpoint in Jenkins Gogs Plugin 1.0.15 and earlier provides unauthenticated attackers information about…
Not rated
CVE-2019-10348
Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be…
Not rated