CVE-2023-37956: 
Java vulnerability analysis and mitigation

A missing permission check vulnerability was identified in Jenkins Test Results Aggregator Plugin versions 1.2.13 and earlier, tracked as CVE-2023-37956. The vulnerability was discovered and reported by Alvaro Muñoz (@pwntester) from GitHub Security Lab and was publicly disclosed on July 12, 2023. The vulnerability affects the form validation functionality in the Jenkins Test Results Aggregator Plugin (Jenkins Advisory, OSS Security).

The vulnerability stems from a missing permission check in an HTTP endpoint that implements form validation. The issue allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password. The vulnerability has been assigned a Medium severity CVSS rating (Jenkins Advisory).

The vulnerability enables attackers with Overall/Read permission to establish connections to arbitrary URLs using specified credentials, potentially leading to unauthorized access and credential exposure (GitHub Security Lab).

As of the advisory publication on July 12, 2023, no fix is available for this vulnerability. Users of the Test Results Aggregator Plugin should monitor for updates and implement additional access controls to restrict Overall/Read permissions where possible (Jenkins Advisory).