GCVE - cpe:2.3:a:jenkins:orka_by_macstadium:*:*:*:*:*:jenkins:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:jenkins:orka_by_macstadium:*:*:*:*:*:jenkins:*:*

part: a version: * update: *

Vendor	Jenkins (`d708d718-2e77-5ca3-ae9c-38ee4d256744`)
Product	Orka By Macstadium (`0f60d038-521f-50c0-9b18-2afed88d6ce9`)
Edition	*
Language	*
Software edition	*
Target software	jenkins
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/jenkinsci/macstadium-orka-plugin`	purl2cpe	2026-06-01 10:14:16.180008

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-37949`	vulnerable	2026-06-08 06:08:16.574375	Details available A missing permission check in Jenkins Orka by MacStadium Plugin 1.33 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Published: 2023-07-12T15:52:51.254Z Updated: 2024-11-06T19:46:49.605Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3128 http://www.openwall.com/lists/oss-security/2023/07/12/2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-24433`	vulnerable	2026-06-08 05:56:05.456593	Details available Missing permission checks in Jenkins Orka by MacStadium Plugin 1.31 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Published: 2023-01-24T00:00:00.000Z Updated: 2025-04-02T14:05:30.865Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2772%20%282%29	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-24432`	vulnerable	2026-06-08 05:56:05.456114	Details available A cross-site request forgery (CSRF) vulnerability in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Published: 2023-01-24T00:00:00.000Z Updated: 2025-04-02T14:22:45.359Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2772%20%282%29	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-24431`	vulnerable	2026-06-08 05:56:05.455562	Details available A missing permission check in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Published: 2023-01-24T00:00:00.000Z Updated: 2025-04-02T14:19:42.068Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2772%20%281%29	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.