Jenkins mabl Plugin Vulnerability Affects Credential Security
CVE-2023-37950

4.3MEDIUM

Key Information:

Vendor

Jenkins
Status
Jenkins Mabl Plugin
Vendor
CVE Published:
12 July 2023

What is CVE-2023-37950?

A missing permission check in the Jenkins mabl Plugin versions 0.0.46 and earlier exposes a significant security flaw. This vulnerability enables attackers with only Overall/Read permissions to gain access to sensitive information, specifically allowing them to enumerate credentials IDs stored within Jenkins, which can lead to further exploits and unauthorized data access.

Affected Version(s)

Jenkins mabl Plugin 0 <= 0.0.46

References

https://www.jenkins.io/security/advisory/2023-07-12/#SECU...
vendor-advisory
http://www.openwall.com/lists/oss-security/2023/07/12/2

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.