CVE-2023-37964: A cross-site request forgery (CSRF) vulnerability in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows...

Security readout for executives and security teams

This Jenkins plugin flaw could let an attacker abuse a logged-in Jenkins user’s browser to make Jenkins contact an attacker-controlled URL and leak stored credentials. The attacker still needs a usable Jenkins credential ID from another source, but successful abuse could expose secrets used in builds or deployments. Exposure is limited to Jenkins environments running ElasticBox CI Plugin 5.0.1 or earlier. Risk is higher where users stay authenticated to Jenkins, credential IDs are discoverable, and stored credentials have access to cloud, deployment, or source systems. Prioritize this if Jenkins stores deployment, cloud, or source-control credentials and the ElasticBox CI Plugin is present. Treat confirmed exposure as a secrets-protection incident because compromised Jenkins credentials can affect build integrity and downstream systems. Mitigation focus: Inventory Jenkins instances for ElasticBox CI Plugin 5.0.1 or earlier.; Check Jenkins vendor guidance for fixed versions or official remediation.; Disable or remove the plugin if it is not operationally required..

Prepared

Jun 2, 2026, 01:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.