{"id":"CVE-2023-49673","details":"A cross-site request forgery (CSRF) vulnerability in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and password.","aliases":["GHSA-wpfc-r5qq-7r7p"],"modified":"2026-07-08T06:27:13.351641907Z","published":"2023-11-29T14:15:07.707Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:jenkins:google_compute_engine:*:*:*:*:*:jenkins:*:*"],"extracted_events":[{"fixed":"4.551.0"}],"source":"CPE_RANGE","vendor_product":"jenkins:google_compute_engine"},{"cpes":["cpe:2.3:a:jenkins:matlab:*:*:*:*:*:jenkins:*:*"],"extracted_events":[{"fixed":"2.11.1"}],"source":"CPE_RANGE","vendor_product":"jenkins:matlab"},{"extracted_events":[{"fixed":"2.2"}],"source":"CPE_RANGE","vendor_product":"jenkins:neuvector_vulnerability_scanner","cpes":["cpe:2.3:a:jenkins:neuvector_vulnerability_scanner:*:*:*:*:*:jenkins:*:*"]}]},"references":[{"type":"ADVISORY","url":"https://www.jenkins.io/security/advisory/2023-11-29/#SECURITY-3256"},{"type":"ARTICLE","url":"http://www.openwall.com/lists/oss-security/2023/11/29/1"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jenkinsci/jira-plugin","events":[{"introduced":"0"},{"fixed":"b372a6f3937d3b390258b7ee48ab5cf10e83751d"}],"database_specific":{"cpe":"cpe:2.3:a:jenkins:jira:*:*:*:*:*:jenkins:*:*","extracted_events":[{"introduced":"0"},{"fixed":"3.1.2"}],"source":"CPE_RANGE"}}],"versions":["jira-3.1.1","jira-3.1.0","jira-3.0.18","jira-3.0.17","jira-3.0.16","jira-3.0.15","jira-3.0.14","jira-3.0.13","jira-3.0.12","3.0.12","jira-3.0.6","jira-3.0.11","jira-3.0.10","jira-3.0.9","jira-3.0.8","jira-3.0.7","jira-3.0.5","jira-3.0.4","jira-3.0.3","jira-3.0.2","jira-3.0.1","jira-3.0.0","jira-2.5.2","jira-2.5.1","jira-2.5","jira-2.4.2","jira-2.4","jira-2.3","jira-2.2.1","jira-2.2","jira-2.1","jira-2.0","jira-1.41","jira-1.40","jira-1.39","jira-1.37","jira-1.36","jira-1.35","jira-1.34","jira-1.33","jira-1.32","jira-1.31","jira-1.30","jira-1.29","jira-1.28","jira-1.27","jira-1.26"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-49673.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}