CVE-2023-37955: 
Java vulnerability analysis and mitigation

A cross-site request forgery (CSRF) vulnerability was discovered in Jenkins Test Results Aggregator Plugin versions 1.2.13 and earlier. The vulnerability was assigned CVE-2023-37955 and was publicly disclosed on July 12, 2023. The vulnerability affects the form validation functionality in the plugin (Jenkins Advisory, NVD).

The vulnerability stems from two security issues: a missing permission check in an HTTP endpoint implementing form validation (CVE-2023-37956) and a CSRF vulnerability (CVE-2023-37955). The CVSS v3.1 base score is 6.5 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (NVD).

The vulnerability allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password. Additionally, because the HTTP endpoint does not require POST requests, it is vulnerable to cross-site request forgery attacks (Jenkins Advisory, GitHub Lab).

As of the advisory publication on July 12, 2023, there is no fix available for this vulnerability in the Test Results Aggregator Plugin. Users should monitor for updates and consider implementing additional security controls to restrict access to the affected endpoints (Jenkins Advisory).