Design/Logic Flaw

A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

Design/Logic Flaw

Jenkins mabl Plugin 0.0.46 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to...

Information disclosure

A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2023-37953

A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2023-37953

A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2023-37953

Summary: Jenkins mabl Plugin versions ≤ 0.0.46 have a missing permission check in several HTTP endpoints, allowing attackers with Overall/Read to access an attacker‑specified URL using attacker‑specified credential IDs and potentially capture credentials stored in Jenkins. This vulnerability also...

CVE-2023-37952

A cross-site request forgery CSRF vulnerability in Jenkins mabl Plugin 0.0.46 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2023-37952

CVE-2023-37952 affects Jenkins mabl Plugin versions 0.0.46 and earlier. The root cause is missing permission checks on several HTTP endpoints, allowing CSRF by attackers who can cause the plugin to connect to an attacker-specified URL using attacker-specified credentials IDs, thereby exposing cre...

CVE-2023-37952

A cross-site request forgery CSRF vulnerability in Jenkins mabl Plugin 0.0.46 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2023-37951

Jenkins mabl Plugin 0.0.46 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to...

CVE-2023-37951

Jenkins mabl Plugin 0.0.46 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to...

CVE-2023-37951

CVE-2023-37951 affects Jenkins mabl Plugin versions 0.0.46 and earlier. The issue arises because the plugin does not set the appropriate context for credentials lookup, enabling attackers with Item/Configure permission to access and capture credentials they should not access. The vulnerability im...

CVE-2023-37950

CVE-2023-37950 affects Jenkins mabl Plugin 0.0.46 and earlier, where a missing permission check in an HTTP endpoint allows users with Overall/Read access to enumerate credentials IDs stored in Jenkins. This can aid credential harvesting or later exploitation per linked advisories (GHSA-23RR-6PHQ-...

PT-2023-26200 · Jenkins · Jenkins Mabl Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins mabl Plugin versions 0.0.46 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method,...

Jenkins Plugin mabl 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

Jenkins Plugin mabl 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

PT-2023-26201 · Jenkins · Jenkins Mabl Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins mabl Plugin versions 0.0.46 and earlier Description: A missing permission check in the Jenkins mabl Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs...

PT-2023-26199 · Jenkins · Jenkins Mabl Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins mabl Plugin versions 0.0.46 and earlier Description: The issue allows attackers with Item/Configure permission to access and capture credentials they are not entitled to, due to the plugin not setting the appropriate context for...

GHSA-HMF2-PRM5-RVXM Jenkins mabl Plugin stores credentials in plain text

Jenkins mabl Plugin stores credentials unencrypted in job config.xml files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

Jenkins mabl Plugin stores credentials in plain text

Jenkins mabl Plugin stores credentials unencrypted in job config.xml files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...