CVE-2023-33004: 
Java vulnerability analysis and mitigation

Tag Profiler Plugin 0.2 and earlier contains a missing permission check vulnerability (CVE-2023-33004) that was disclosed on May 16, 2023. The vulnerability affects the Jenkins Tag Profiler Plugin and allows attackers with Overall/Read permission to reset profiler statistics (Jenkins Advisory).

The vulnerability stems from a missing permission check in an HTTP endpoint in the Tag Profiler Plugin. This security flaw allows attackers with Overall/Read permission to reset profiler statistics without proper authorization. The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (MEDIUM) with vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (NVD).

The vulnerability allows attackers with Overall/Read permission to reset profiler statistics, potentially disrupting profiling data collection and analysis. This could affect the monitoring and performance analysis capabilities of Jenkins installations using the Tag Profiler Plugin (Jenkins Advisory).

As of the advisory publication date, there is no fix available for this vulnerability in the Tag Profiler Plugin. Users should monitor for updates and consider implementing additional access controls or removing the plugin if the risk is deemed too high (Jenkins Advisory).