CVE-2023-37956: A missing permission check in Jenkins Test Results Aggregator Plugin 1.2.13 and earlier allows attackers wi...

Security readout for executives and security teams

This Jenkins plugin flaw lets a user with basic Jenkins read access make the Test Results Aggregator Plugin connect to a URL they choose, with credentials they specify. The business concern is unauthorized use of Jenkins as a trusted internal system. Evidence in the bundle does not show active exploitation or a public CVSS score. Exposure is likely limited to Jenkins controllers with Test Results Aggregator Plugin 1.2.13 or earlier installed and users granted Overall/Read. Risk increases if anonymous or broadly distributed accounts have Overall/Read access. Prioritize remediation where Jenkins is broadly accessible, holds sensitive credentials, or can reach internal systems. The issue is not KEV-listed in the provided sources, but Jenkins often sits in privileged delivery paths, so unnecessary exposure should be reduced promptly. Mitigation focus: Inventory Jenkins instances for Test Results Aggregator Plugin 1.2.13 or earlier.; Review the Jenkins advisory for fixed versions or vendor-supported remediation.; Upgrade or disable the plugin according to Jenkins guidance..

Prepared

Jun 2, 2026, 01:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.