CVE-2023-37964

Jenkins ElasticBox CI Plugin vulnerable to cross-site request forgery

8.8 High

A cross-site request forgery (CSRF) vulnerability in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.59%Up 0.6 points since Jul 14, 2023

What each source reports

NVD Score used 8.8

Record: CVE-2023-37964
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-352
Updated: 2026-11-02

CVE List No score

Record: CVE-2023-37964
Updated: 2026-11-02

EUVDEUVD-2023-1971 0.0

Record: EUVD-2023-1971
CVSS: 0.0 NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5v46-54vj-4mjq 8.8

Jenkins ElasticBox CI Plugin vulnerable to cross-site request forgery

Jenkins ElasticBox CI Plugin 5.0.1 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Record: GHSA-5v46-54vj-4mjq
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-352
Updated: 2026-11-02

OSV 8.8

Record: CVE-2023-37964
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-5v46-54vj-4mjq 8.8

Jenkins ElasticBox CI Plugin vulnerable to cross-site request forgery

Jenkins ElasticBox CI Plugin 5.0.1 and earlier does not perform permission checks in several HTTP endpoints.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Record: GHSA-5v46-54vj-4mjq
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-352
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.jenkins-ci.plugins:elasticbox` Maven	through 5.0.3	None known
`org.jenkins-ci.plugins:elasticbox` Maven	through 5.0.3, plus listed versions 0.70.7.10.7.20.7.30.7.4 Show 38 moreShow less 0.80.8.10.8.20.8.30.8.40.8.50.8.60.8.70.8.80.8.90.90.9.10.9.100.9.10.10.9.10.20.9.110.9.120.9.130.9.140.9.20.9.30.9.40.9.50.9.60.9.70.9.80.9.8.10.9.8.20.9.94.0.04.0.14.0.24.0.34.0.44.0.54.0.64.0.74.0.8	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-37964 is a high vulnerability (CVSS 8.8) in Jenkins Elasticbox Ci, published July 12, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. No source names a fixed version.