CVE-2023-28672

Name of the Vulnerable Software and Affected Versions Jenkins OctoPerf Load Testing Plugin Plugin versions 4.5.1 and earlier

Description The issue allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. This is due to a lack of permission check in a connection test HTTP endpoint.

Recommendations For versions 4.5.1 and earlier, update to version 4.5.2 or later, which properly performs a permission check when accessing the affected connection test HTTP endpoint. As a temporary workaround, consider restricting access to the connection test HTTP endpoint to minimize the risk of exploitation.