CVE-2023-37964: CSRF
A cross-site request forgery (CSRF) vulnerability in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Other sources
Jenkins ElasticBox CI Plugin 5.0.1 and earlier does not perform permission checks in several HTTP endpoints.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-37964?
CVE-2023-37964 is considered a medium severity vulnerability due to its potential for credential theft.
How do I fix CVE-2023-37964?
To fix CVE-2023-37964, upgrade the Jenkins ElasticBox CI Plugin to version 5.0.2 or later.
What software is affected by CVE-2023-37964?
The affected software for CVE-2023-37964 is the Jenkins ElasticBox CI Plugin version 5.0.1 and earlier.
What type of vulnerability is CVE-2023-37964?
CVE-2023-37964 is a cross-site request forgery (CSRF) vulnerability.
What can attackers do with CVE-2023-37964?
Attackers exploiting CVE-2023-37964 can connect to an attacker-specified URL, potentially capturing sensitive credentials stored in Jenkins.