Medium severity6.5NVD Advisory· Published Jan 26, 2023· Updated Jun 17, 2026

CVE-2023-24423

Description

A cross-site request forgery (CSRF) vulnerability in Jenkins Gerrit Trigger Plugin 2.38.0 and earlier allows attackers to rebuild previous builds triggered by Gerrit.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
com.sonyericsson.hudson.plugins.gerrit:gerrit-triggerMaven	< 2.38.1	2.38.1

Affected products

Jenkins Project/Gerrit Trigger
cpe:2.3:a:jenkins:gerrit_trigger:*:*:*:*:*:jenkins:*:*
Range: <2.38.1
ghsa-coords
pkg:maven/com.sonyericsson.hudson.plugins.gerrit/gerrit-trigger
Range: < 2.38.1
Jenkins Project/Gerrit Trigger Plugincpe-rescue
Range: unspecified

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-95jq-24cr-pgrqghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-24423ghsaADVISORY
www.jenkins.io/security/advisory/2023-01-24/nvdVendor AdvisoryWEB
github.com/jenkinsci/gerrit-trigger-plugin/commit/691d76fdf54d659f8585ea3cbc3cce60d9edfec8ghsaWEB

News mentions

Jenkins Security Advisory 2023-01-24
Jenkins Security Advisories · Jan 24, 2023

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000