~ / search / GHSA-4c3q-r84r-q6pp

GHSA-4c3q-r84r-q6pp

Jenkins mabl Plugin vulnerable to exposure of system-scooped credentials

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-37951

Packages

EcosystemPackageAffectedFixed in
Maven com.mabl.integration.jenkins:mabl-integration < 0.0.47 0.0.47

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins mabl Plugin 0.0.46 and earlier does not set the appropriate context for credentials lookup, allowing the use of System-scoped credentials otherwise reserved for the global configuration. This allows attackers with Item/Configure permission to access and capture credentials they are not entitled to. mabl Plugin 0.0.47 defines the appropriate context for credentials lookup.

References

External links from the advisory. They lead to third-party sites.