CVE-2023-23847: jenkins synopsys_coverity Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2023-23847 is a low (CVSS 3.5) Cross-Site Request Forgery (CSRF) vulnerability in jenkins synopsys_coverity. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.2% of scored vulnerabilities.

Timeline

1. 15-02-2023
   PublishedVulnerability first disclosed.
2. 19-03-2025
   Last modifiedVulnerability information updated.

Description

A cross-site request forgery (CSRF) vulnerability in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.