CVE-2023-49655

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A cross-site request forgery (CSRF) vulnerability in Jenkins MATLAB Plugin 2.11.0 and earlier allows attackers to have Jenkins parse an XML file from the Jenkins controller file system.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Nov 29, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-496569.8Jenkins MATLAB Plugin 2.11.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.CVE-2023-496575.4A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permiCVE-2023-496589.8Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'bank_details' parameter of the party_subCVE-2023-49667.5Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RCVE-2023-496659.8Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'quantity[]' parameter of the submit_deliCVE-2023-496669.8Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'custmer_details' parameter of the submitCVE-2023-49677.5Denial of Service in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AACVE-2023-496738.8A cross-site request forgery (CSRF) vulnerability in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers to conCVE-2023-496744.3A missing permission check in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers with Overall/Read permission CVE-2023-496757.8An unauthenticated local attacker may trick a user to open corrupted project files to execute arbitrary code or crash the system due to an oCVE-2023-496765.5An unauthenticated local attacker may trick a user to open corrupted project files to crash the system due to use after free vulnerability.CVE-2023-496779.8Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'cmbQual' parameter of the Employer/InsertJob.p