Jenkins Sumologic Publisher Plugin missing permission check

MITTEL 6.5CVE-2023-37959 · GHSA-mx84-frhw-pcg8 · Published 12/07/2023 · updated 17/06/2026

Kurz gesagt

CVE-2023-37959 ist eine Schwachstelle (MITTEL (CVSS 6.5)) in org.jenkins-ci.plugins:sumologic-publisher, sumologic publisher (jenkins).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.55%, höher als bei 45.9% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:sumologic-publisher Maven	`≤ 2.2.1`	No fix yet
sumologic publisher jenkins	`≤ 2.2.1`	No fix yet

Description

Jenkins Sumologic Publisher Plugin 2.2.1 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

NVD description

A missing permission check in Jenkins Sumologic Publisher Plugin 2.2.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.

References

nvd.nist.gov/vuln/detail/CVE-2023-37959 · ADVISORY
jenkins.io/security/advisory/2023-07-12 · WEB
openwall.com/lists/oss-security/2023/07/12/2 · WEB

Weitere Schwachstellen in org.jenkins-ci.plugins:sumologic-publisher

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Kurz gesagt

CVE-2023-37959 ist eine Schwachstelle (MITTEL (CVSS 6.5)) in org.jenkins-ci.plugins:sumologic-publisher, sumologic publisher (jenkins).

Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.55%, höher als bei 45.9% aller Schwachstellen.

Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:sumologic-publisher

Maven

≤ 2.2.1

No fix yet

sumologic publisher

jenkins

≤ 2.2.1

No fix yet

Description

Jenkins Sumologic Publisher Plugin 2.2.1 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

NVD description

A missing permission check in Jenkins Sumologic Publisher Plugin 2.2.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.