CVE-2023-40349

Jenkins Gogs Plugin versions 1.0.15 and earlier improperly initialize an option meant to secure the webhook endpoint, leaving it unprotected [1][3]. This flaw allows any unauthenticated attacker with network access to the Jenkins instance to trigger builds of jobs configured to use the Gogs plugin [1][2].

By simply sending a request to the webhook endpoint, an attacker can cause arbitrary builds to be triggered without any authentication [2]. This can lead to unauthorized execution of build steps, potentially consuming resources or exposing sensitive data if the build process is misused.

As of the advisory date, the vulnerability remains unresolved in the Gogs Plugin [2]. Users are advised to disable the plugin or restrict network access to the Jenkins instance until a fix is available [1].