com.mabl.integration.jenkins:mabl-integration (>=0.0.5, <=0.0.19), org.jenkins-ci.plugins:hockeyapp (>=1.3.0, <=1.3.3) +2 more potentially affected by CVE-2024-39458 via org.jenkins-ci.plugins:structs (1.13)

org.jenkins-ci.plugins:structs MAVEN version 1.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:structs and may be impacted: - com.mabl.integration.jenkins:mabl-integration =0.0.5, =1.3.0, =1.2.1, =2.0.0, =2.1.0 Source cves:...

Missing permission check in mabl-integration allows enumerating credentials IDs

mabl-integration 0.0.46 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...

Exposure of system-scoped credentials in mabl-integration

mabl-integration 0.0.46 and earlier does not set the appropriate context for credentials lookup, allowing the use of System-scoped credentials otherwise reserved for the global configuration. This allows attackers with Item/Configure permission to access and capture credentials they are not...