CVE-2023-37965

HighCVSS 7.1

Published: 12/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.63%

45th percentile - higher than 45% of all known CVEs

Summary

A missing permission check in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Risk Assessment

Attackers may gain access to sensitive credentials, potentially leading to further attacks on the organization's systems and data breaches.

Recommendation

It is recommended to update the Jenkins ElasticBox CI Plugin to the latest version and review user permissions to restrict access to critical functions.

Other vulnerabilities in Jenkins ElasticBox CI Plugin

CVE-2023-37964High
The Jenkins ElasticBox CI Plugin version 5.0.1 and earlier contains a cross-site request forgery (CSRF) vulnerability that allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS