Jenkins Test Results Aggregator Plugin 1.2.13 and earlier does not perform a permission check in an HTTP endpoint implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.

Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-37955
• https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3122
• http://www.openwall.com/lists/oss-security/2023/07/12/2
• jenkinsci/test-results-aggregator-plugin@7dc2906