CVE-2023-37952

A cross-site request forgery (CSRF) vulnerability in Jenkins mabl Plugin 0.0.46 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkins [1].

To exploit this, an attacker must first obtain valid credential IDs from Jenkins, possibly via another vulnerability. Then, the attacker tricks a Jenkins user with sufficient permissions into clicking a malicious link, causing the plugin to transmit the credentials to the attacker's URL. This attack does not require authentication to the plugin itself, but relies on the victim's authenticated session.

Successful exploitation leads to credential disclosure, which can compromise the Jenkins instance and any systems accessible with those credentials.

The vulnerability is fixed in mabl Plugin version 0.0.47, as announced in the Jenkins security advisory on July 12, 2023 [1][2]. Users should upgrade immediately as no workaround exists.