CVE-2023-28673: 
Java vulnerability analysis and mitigation

A missing permission check vulnerability was discovered in Jenkins OctoPerf Load Testing Plugin Plugin versions 4.5.2 and earlier. The vulnerability was assigned CVE-2023-28673 and was disclosed on March 21, 2023. The vulnerability affects the plugin's HTTP endpoint functionality (Jenkins Advisory, NVD).

The vulnerability stems from a missing permission check in an HTTP endpoint of the plugin. The issue has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified under CWE-862 (Missing Authorization) (NVD).

This vulnerability allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. The enumerated credentials IDs could potentially be used as part of a broader attack to capture the actual credentials when combined with other vulnerabilities (Jenkins Advisory).

The vulnerability has been fixed in OctoPerf Load Testing Plugin Plugin version 4.5.3, which requires appropriate permissions for credentials ID enumeration. Users are advised to upgrade to this version to address the security issue (Jenkins Advisory).