Cross-Site Request Forgery Vulnerability in Jenkins mabl Plugin
CVE-2023-37952

6.5MEDIUM

Key Information:

Vendor

Jenkins
Status
Jenkins Mabl Plugin
Vendor
CVE Published:
12 July 2023

What is CVE-2023-37952?

A cross-site request forgery (CSRF) vulnerability in the Jenkins mabl Plugin versions 0.0.46 and earlier exposes users to significant security risks. This flaw allows attackers to execute requests using credentials they have obtained from other methods, potentially gaining access to sensitive information stored within Jenkins. By exploiting this vulnerability, an attacker could direct the Jenkins server to connect to a URL of their choosing, using the compromised user credentials. It's crucial for users of the mabl Plugin to update to the latest version to mitigate the effects of this vulnerability.

Affected Version(s)

Jenkins mabl Plugin 0 <= 0.0.46

References

https://www.jenkins.io/security/advisory/2023-07-12/#SECU...
vendor-advisory
http://www.openwall.com/lists/oss-security/2023/07/12/2

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-37952 : Cross-Site Request Forgery Vulnerability in Jenkins mabl Plugin