Jenkins Lucene-Search Plugin vulnerable to Cross-Site Request Forgery

MOYENNE 4.3CVE-2023-30529 · GHSA-gh5w-gffh-68pr · Published 12/04/2023 · updated 17/06/2026

En bref

CVE-2023-30529 est une vulnérabilité MOYENNE (CVSS 4.3) touchant org.jenkins-ci.plugins:lucene-search, lucene-search (jenkins).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.35%, plus élevée que 28.6% des vulnérabilités.
Correctif : mettre à jour vers 398.v3dfa_cb_223984 ou plus récent.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:lucene-search Maven	`< 398.v3dfa_cb_223984`	`398.v3dfa_cb_223984`
lucene-search jenkins	`≤ 387.v938a_ecb_f7fe9`	No fix yet

Description

Jenkins Lucene-Search Plugin 387.v938a_ecb_f7fe9 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to reindex the database.

NVD description

Jenkins Lucene-Search Plugin 387.v938a_ecb_f7fe9 and earlier does not require POST requests for an HTTP endpoint, allowing attackers to reindex the database.

References

nvd.nist.gov/vuln/detail/CVE-2023-30529 · ADVISORY
jenkinsci/lucene-search-plugin commit 828f79f · WEB
jenkinsci/lucene-search-plugin commit ffd6916 · WEB
jenkins.io/security/advisory/2023-04-12 · WEB
openwall.com/lists/oss-security/2023/04/13/3 · WEB

Autres vulnérabilités de org.jenkins-ci.plugins:lucene-search

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

En bref

CVE-2023-30529 est une vulnérabilité MOYENNE (CVSS 4.3) touchant org.jenkins-ci.plugins:lucene-search, lucene-search (jenkins).

Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.35%, plus élevée que 28.6% des vulnérabilités.

Correctif : mettre à jour vers 398.v3dfa_cb_223984 ou plus récent.

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:lucene-search

Maven

< 398.v3dfa_cb_223984

398.v3dfa_cb_223984

lucene-search

jenkins

≤ 387.v938a_ecb_f7fe9

No fix yet

Description

Jenkins Lucene-Search Plugin 387.v938a_ecb_f7fe9 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to reindex the database.

NVD description

Jenkins Lucene-Search Plugin 387.v938a_ecb_f7fe9 and earlier does not require POST requests for an HTTP endpoint, allowing attackers to reindex the database.

Autres vulnérabilités de org.jenkins-ci.plugins:lucene-search

Tout voir →