1. Home
  2. Security Advisories
  3. Jenkins
  4. JENKINS:SECURITY-3127

[JENKINS:SECURITY-3127] CSRF vulnerability and missing permission checks in `mabl-integration` allow capturing credentials

Severity High
Affected Packages 2
Fixed Packages 2
CVEs 2
Info Packages References Vulnerabilities

mabl-integration 0.0.46 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

mabl-integration 0.0.47 requires POST requests and the appropriate permissions for the affected HTTP endpoints.

Package Affected Version
pkg:maven/org.jenkins-ci.plugins/mabl-integration <= 0.0.46
pkg:github/jenkinsci/mabl-integration-plugin <= 0.0.46
Package Fixed Version
pkg:maven/org.jenkins-ci.plugins/mabl-integration = 0.0.47
pkg:github/jenkinsci/mabl-integration-plugin = 0.0.47
ID
JENKINS:SECURITY-3127
Severity
high
Published
2023-07-12T00:00:00
(14 months ago)
Modified
2023-07-12T00:00:00
(14 months ago)
Rights
Jenkins Security Team
Other Advisories
Source # ID Name URL
Plugin repository mabl-integration repository https://github.com/jenkinsci/mabl-integration-plugin
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.jenkins-ci.plugins/mabl-integration org.jenkins-ci.plugins mabl-integration <= 0.0.46
Fixed pkg:maven/org.jenkins-ci.plugins/mabl-integration org.jenkins-ci.plugins mabl-integration = 0.0.47
Affected pkg:github/jenkinsci/mabl-integration-plugin jenkinsci mabl-integration-plugin <= 0.0.46
Fixed pkg:github/jenkinsci/mabl-integration-plugin jenkinsci mabl-integration-plugin = 0.0.47
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date