Jenkins Elasticbox Ci vulnerabilities

3 CVEs affecting Jenkins Elasticbox Ci, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-37965, published 2023-07-12.

More from Jenkins.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-37965, published 2023-07-12. High severity, CVSS 7.1. EPSS: 0.7% chance of exploitation in the next 30 days. A missing permission check in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials…
• CVE-2023-37964, published 2023-07-12. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. A cross-site request forgery (CSRF) vulnerability in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs…
• CVE-2019-10450, published 2019-10-16. Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days. Jenkins ElasticBox CI Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system.