CVE-2023-28674: 
Java vulnerability analysis and mitigation

A cross-site request forgery (CSRF) vulnerability was discovered in Jenkins OctoPerf Load Testing Plugin Plugin versions 4.5.2 and earlier. The vulnerability was assigned identifier CVE-2023-28674 and was disclosed on March 21, 2023. The affected component is the Jenkins OctoPerf Load Testing Plugin, which failed to implement proper security controls in several HTTP endpoints (Jenkins Advisory).

The vulnerability stems from the plugin's failure to perform permission checks in several HTTP endpoints and not requiring POST requests. The vulnerability has a CVSS v3.1 base score of 8.8 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

This vulnerability allows attackers with Overall/Read permission to connect to a previously configured Octoperf server using attacker-specified credentials. The high CVSS score indicates potential severe impacts on confidentiality, integrity, and availability of the affected systems (Jenkins Advisory).

The vulnerability has been fixed in OctoPerf Load Testing Plugin Plugin version 4.5.3, which implements proper permission checks and requires POST requests for the affected HTTP endpoints. Users are advised to upgrade to this version to mitigate the vulnerability (Jenkins Advisory).