CVE-2023-30521

Name of the Vulnerable Software and Affected Versions Jenkins Assembla merge request builder Plugin versions 1.1.13 and earlier

Description A missing permission check in the Jenkins Assembla merge request builder Plugin allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository. The plugin provides a webhook endpoint at "/assembla-webhook/" that can be accessed without authentication, enabling this exploit.

Recommendations For Jenkins Assembla merge request builder Plugin versions 1.1.13 and earlier, consider disabling the /assembla-webhook/ endpoint until a patch is available to prevent unauthenticated access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.