GHSA-23rr-6phq-5p65

Suggest an improvement
Source
https://github.com/advisories/GHSA-23rr-6phq-5p65
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-23rr-6phq-5p65/GHSA-23rr-6phq-5p65.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-23rr-6phq-5p65
Aliases
  • CVE-2023-37950
Published
2023-07-12T18:30:38Z
Modified
2024-02-16T08:10:46.130888Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Jenkins mabl Plugin missing permission check
Details

Jenkins mabl Plugin 0.0.46 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in mabl Plugin 0.0.47 requires the appropriate permissions.

References

Affected packages

Maven / com.mabl.integration.jenkins:mabl-integration

Package

Name
com.mabl.integration.jenkins:mabl-integration
View open source insights on deps.dev
Purl
pkg:maven/com.mabl.integration.jenkins/mabl-integration

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.0.47

Affected versions

0.*

0.0.5
0.0.6
0.0.7
0.0.8
0.0.9
0.0.10
0.0.12
0.0.13
0.0.14
0.0.15
0.0.16
0.0.17
0.0.18
0.0.19
0.0.21
0.0.22
0.0.23
0.0.25
0.0.26
0.0.28
0.0.29
0.0.30
0.0.31
0.0.32
0.0.34
0.0.35
0.0.36
0.0.37
0.0.38
0.0.39
0.0.40
0.0.42
0.0.43
0.0.44
0.0.45
0.0.46