Skip to content
Sign in
Not rated

CVE-2023-37965 A missing permission check in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers with Overall/Read…

Description

A missing permission check in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Affected products and versions

Product Affected versions Fixed in
Jenkins ElasticBox CI Plugin 5.0 earliest → 5.0.1 No fix stated

Other CVEs of Jenkins ElasticBox CI Plugin

The 3 CVEs of Jenkins ElasticBox CI Plugin →
CVE-2023-37964 A cross-site request forgery (CSRF) vulnerability in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers… Not rated CVE-2019-10450 Jenkins ElasticBox CI Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins… Not rated
Track this CVE