CVE-2023-37952

CVE-2023-37952 affects Jenkins mabl Plugin versions 0.0.46 and earlier. The root cause is missing permission checks on several HTTP endpoints, allowing CSRF by attackers who can cause the plugin to connect to an attacker-specified URL using attacker-specified credentials IDs, thereby exposing cre...

CVE-2019-10283

The CVE-2019-10283 entry relates to the Jenkins mabl Plugin storing credentials unencrypted in job config.xml files on the Jenkins master/controller, allowing access by users with Extended Read permission or direct master access. This vulnerability is consistently described across multiple source...

CVE-2023-37950

CVE-2023-37950 affects Jenkins mabl Plugin 0.0.46 and earlier, where a missing permission check in an HTTP endpoint allows users with Overall/Read access to enumerate credentials IDs stored in Jenkins. This can aid credential harvesting or later exploitation per linked advisories (GHSA-23RR-6PHQ-...

CVE-2023-37953

Summary: Jenkins mabl Plugin versions ≤ 0.0.46 have a missing permission check in several HTTP endpoints, allowing attackers with Overall/Read to access an attacker‑specified URL using attacker‑specified credential IDs and potentially capture credentials stored in Jenkins. This vulnerability also...

CVE-2023-37951

CVE-2023-37951 affects Jenkins mabl Plugin versions 0.0.46 and earlier. The issue arises because the plugin does not set the appropriate context for credentials lookup, enabling attackers with Item/Configure permission to access and capture credentials they should not access. The vulnerability im...