Jenkins Jenkins Jenkins CI / CD Server

  1. Vendors
  2. Jenkins
Do you want an email whenever new security vulnerabilities are reported in any Jenkins product?

Products by Jenkins Sorted by Most Security Vulnerabilities since 2018

Jenkins101 vulnerabilities
Continuous Integration Engine

Jenkins Pipeline26 vulnerabilities

Jenkins Script Security20 vulnerabilities

Jenkins Configuration As Code9 vulnerabilities

Jenkins Blue Ocean8 vulnerabilities

Jenkins Git8 vulnerabilities

Jenkins Active Directory7 vulnerabilities

Jenkins Amazon Ec26 vulnerabilities

Jenkins Electricflow6 vulnerabilities

Jenkins Warnings Next Generation6 vulnerabilities

Jenkins Xebialabs Xl Deploy6 vulnerabilities

Jenkins Kubernetes6 vulnerabilities

Jenkins Subversion6 vulnerabilities

Jenkins Config File Provider6 vulnerabilities

Jenkins Mercurial6 vulnerabilities

Jenkins Publish Over Ssh5 vulnerabilities

Jenkins Promoted Builds5 vulnerabilities

Jenkins Pipeline Maven Integration5 vulnerabilities

Jenkins Job And Node Ownership5 vulnerabilities

Jenkins Extended Choice Parameter5 vulnerabilities

Jenkins Rundeck5 vulnerabilities

Jenkins Project Inheritance5 vulnerabilities

Jenkins Chef Sinatra5 vulnerabilities

Jenkins Gerrit Trigger5 vulnerabilities

Jenkins Websphere Deployer5 vulnerabilities

Jenkins Credentials Binding5 vulnerabilities

Jenkins Active Choices4 vulnerabilities

Jenkins Mailer4 vulnerabilities

Jenkins P44 vulnerabilities

Jenkins Rapiddeploy4 vulnerabilities

Jenkins Git Parameter4 vulnerabilities

Jenkins S3 Publisher4 vulnerabilities

Jenkins Vmware Lab Manager Slaves4 vulnerabilities

Jenkins Google Compute Engine4 vulnerabilities

Jenkins Kubernetes Ci4 vulnerabilities

Jenkins Liquibase Runner4 vulnerabilities

Jenkins Build Failure Analyzer4 vulnerabilities

Jenkins Matrix Project4 vulnerabilities

Jenkins Fortify On Demand4 vulnerabilities

Jenkins Proxmox4 vulnerabilities

Jenkins Support Core4 vulnerabilities

Jenkins Team Foundation Server3 vulnerabilities

Jenkins Jira3 vulnerabilities

Jenkins Kmap3 vulnerabilities

Jenkins Pipeline Github Notify Step3 vulnerabilities

Jenkins Job Import3 vulnerabilities

Jenkins Ftp Publisher3 vulnerabilities

Jenkins Ansible Tower3 vulnerabilities

Jenkins Team Concert3 vulnerabilities

Jenkins Scriptler3 vulnerabilities

Jenkins Docker3 vulnerabilities

Jenkins Zephyr Enterprise Test Management3 vulnerabilities

Jenkins Tracetronic Ecu Test3 vulnerabilities

Jenkins Kubernetes Continuous Deploy3 vulnerabilities

Jenkins Audit To Database3 vulnerabilities

Jenkins Audit Trail3 vulnerabilities

Jenkins Autocomplete Parameter3 vulnerabilities

Jenkins Openshift Deployer3 vulnerabilities

Jenkins Netsparker Cloud Scan3 vulnerabilities

Jenkins Relution Enterprise Appstore Publisher3 vulnerabilities

Jenkins Gitlab Authentication3 vulnerabilities

Jenkins Gitlab3 vulnerabilities

Jenkins Azure Ad3 vulnerabilities

Jenkins Github3 vulnerabilities

Jenkins Hashicorp Vault3 vulnerabilities

Jenkins Azure Vm Agents3 vulnerabilities

Jenkins Dynatrace Application Monitoring3 vulnerabilities

Jenkins Static Analysis Utilities3 vulnerabilities

Jenkins Zephyr Jira Test Management3 vulnerabilities

Jenkins Black Duck Hub3 vulnerabilities

Jenkins Mac3 vulnerabilities

Jenkins Libvirt Slaves3 vulnerabilities

Jenkins Dbcharts3 vulnerabilities

Jenkins Maven3 vulnerabilities

Jenkins Nomad3 vulnerabilities

Jenkins Repository Connector3 vulnerabilities

Jenkins Email Extension3 vulnerabilities

Jenkins Dashboard View3 vulnerabilities

Jenkins Cloudbees Aws Credentials3 vulnerabilities

Jenkins Github Pull Request Builder3 vulnerabilities

Jenkins Repo3 vulnerabilities

Jenkins Requests3 vulnerabilities

Jenkins Code Coverage Api3 vulnerabilities

Jenkins Ssh3 vulnerabilities

Jenkins Icescrum3 vulnerabilities

Jenkins Health Advisor By Cloudbees3 vulnerabilities

Jenkins Conjur Secrets3 vulnerabilities

Jenkins Continuous Integration With Toad Edge3 vulnerabilities

Jenkins Soasta Cloudtest3 vulnerabilities

Jenkins Vsphere3 vulnerabilities

Jenkins Warnings3 vulnerabilities

Jenkins Crx Content Package Deployer3 vulnerabilities

Jenkins Credentials3 vulnerabilities

Jenkins Alauda Devops Pipeline2 vulnerabilities

Jenkins Ansible2 vulnerabilities

Jenkins Autonomiq2 vulnerabilities

Jenkins Koji2 vulnerabilities

Jenkins Kubernetes Pipeline2 vulnerabilities

Jenkins Bitbucket Server Integration2 vulnerabilities

Jenkins Build With Parameters2 vulnerabilities

Recent Jenkins Security Advisories

Advisory Title Published
Jenkins Security Advisory 2022-05-17 May 17, 2022
Jenkins Security Advisory 2022-04-12 April 12, 2022
Jenkins Security Advisory 2022-03-29 March 29, 2022
Jenkins Security Advisory 2022-03-15 March 15, 2022
Jenkins Security Advisory 2022-02-15 February 15, 2022
Jenkins Security Advisory 2022-02-09 February 9, 2022
Jenkins Security Advisory 2022-01-12 January 12, 2022
Jenkins Security Advisory 2021-11-12 November 12, 2021
Jenkins Security Advisory 2021-11-04 November 4, 2021
Jenkins Security Advisory 2021-10-06 October 6, 2021

@jenkinsci Tweets

RT @ITNEXT_DevOps: Jenkins Tutorial — Part 9 — Basic Pipeline Steps by @b9t_ir at #ITNEXT. #jenkins #devops #cicd #jenkinspipeline #cicdpip…
Mon Jun 27 09:18:41 +0000 2022

RT @CloudIslamabad: Learn the fundamentals required to implement (CI) and (CD) workflows using the @jenkinsci automation server in this fre…
Fri Jun 24 17:40:42 +0000 2022

RT @aheritier: It was supposed to be done for a long time and it’s now done: a new release of the pipeline-maven-plugin for @jenkinsci is o…
Thu Jun 23 06:38:57 +0000 2022

The Jenkins security team has issued a security advisory today for Jenkins core and Jenkins plugins. It contains mu… https://t.co/R6I6Q8ZEIr
Wed Jun 22 14:31:41 +0000 2022

Jenkins is improving the user experience with SVG icons as part of Jenkins 2.346.1 this Wednesday, June 22, 2022. R… https://t.co/34hsqxqLxp
Mon Jun 20 18:52:56 +0000 2022

By the Year

In 2022 there have been 159 vulnerabilities in Jenkins with an average score of 6.3 out of ten. Last year Jenkins had 102 security vulnerabilities published. That is, 57 more vulnerabilities have already been reported in 2022 as compared to last year. Last year, the average CVE base score was greater by 0.24

Year Vulnerabilities Average Score
2022 159 6.26
2021 102 6.50
2020 173 6.09
2019 340 6.91
2018 120 6.45

It may take a day or so for new Jenkins vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Jenkins Security Vulnerabilities

Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints

CVE-2022-30954 6.5 - Medium - May 17, 2022

Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP server.

AuthZ

A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier

CVE-2022-30953 6.5 - Medium - May 17, 2022

A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server.

Session Riding

Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier

CVE-2022-30952 6.5 - Medium - May 17, 2022

Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins.

Insufficiently Protected Credentials

Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library does not implement access control, potentially

CVE-2022-30951 8.8 - High - May 17, 2022

Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library does not implement access control, potentially allowing users to start processes even if they're not allowed to log in.

AuthZ

Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library which has a buffer overflow vulnerability

CVE-2022-30950 8.8 - High - May 17, 2022

Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library which has a buffer overflow vulnerability that may allow users able to connect to a named pipe to execute commands on the Windows agent machine.

Classic Buffer Overflow

Jenkins REPO Plugin 1.14.0 and earlier

CVE-2022-30949 5.3 - Medium - May 17, 2022

Jenkins REPO Plugin 1.14.0 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.

Jenkins Mercurial Plugin 2.16 and earlier

CVE-2022-30948 7.5 - High - May 17, 2022

Jenkins Mercurial Plugin 2.16 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.

Jenkins Git Plugin 4.11.1 and earlier

CVE-2022-30947 7.5 - High - May 17, 2022

Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.

A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier

CVE-2022-30946 4.3 - Medium - May 17, 2022

A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-specified webserver.

Session Riding

Jenkins Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier

CVE-2022-30945 10 - Critical - May 17, 2022

Jenkins Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier allows loading any Groovy source files on the classpath of Jenkins and Jenkins plugins in sandboxed pipelines.

Files or Directories Accessible to External Parties

Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint

CVE-2022-30955 6.5 - Medium - May 17, 2022

Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

AuthZ

Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions

CVE-2022-30956 5.4 - Medium - May 17, 2022

Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Rundeck webhook payloads.

XSS

A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier

CVE-2022-30957 4.3 - Medium - May 17, 2022

A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

AuthZ

Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters

CVE-2022-30963 5.4 - Medium - May 17, 2022

Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

XSS

Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Variable String parameters on views displaying parameters

CVE-2022-30962 5.4 - Medium - May 17, 2022

Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Variable String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

XSS

Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String parameters on views displaying parameters

CVE-2022-30961 5.4 - Medium - May 17, 2022

Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

XSS

Jenkins Application Detector Plugin 1.0.8 and earlier does not escape the name of Chois Application Version parameters on views displaying parameters

CVE-2022-30960 5.4 - Medium - May 17, 2022

Jenkins Application Detector Plugin 1.0.8 and earlier does not escape the name of Chois Application Version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

XSS

Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVE-2022-30971 8.8 - High - May 17, 2022

Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

XXE

Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names in an unsafe manner

CVE-2022-30970 5.4 - Medium - May 17, 2022

Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names in an unsafe manner from Javascript embedded in view definitions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

XSS

A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier

CVE-2022-30969 8.8 - High - May 17, 2022

A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute arbitrary code without sandbox protection if the victim is an administrator.

Session Riding

Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views displaying parameters

CVE-2022-30966 5.4 - Medium - May 17, 2022

Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

XSS

A cross-site request forgery (CSRF) vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier

CVE-2022-30972 8.8 - High - May 17, 2022

A cross-site request forgery (CSRF) vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse a local XML file (e.g., archived artifacts) that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Session Riding

Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters

CVE-2022-30968 5.4 - Medium - May 17, 2022

Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

XSS

Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on views displaying parameters

CVE-2022-30967 5.4 - Medium - May 17, 2022

Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

XSS

Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views displaying parameters

CVE-2022-30965 5.4 - Medium - May 17, 2022

Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

XSS

Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views displaying parameters

CVE-2022-30964 5.4 - Medium - May 17, 2022

Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

XSS

A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier

CVE-2022-30959 6.5 - Medium - May 17, 2022

A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

AuthZ

A cross-site request forgery (CSRF) vulnerability in Jenkins SSH Plugin 2.6.1 and earlier

CVE-2022-30958 8.8 - High - May 17, 2022

A cross-site request forgery (CSRF) vulnerability in Jenkins SSH Plugin 2.6.1 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Session Riding

Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins controller where they

CVE-2022-29052 4.3 - Medium - April 12, 2022

Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

Insufficiently Protected Credentials

Missing permission checks in Jenkins Publish Over FTP Plugin 1.16 and earlier

CVE-2022-29051 4.3 - Medium - April 12, 2022

Missing permission checks in Jenkins Publish Over FTP Plugin 1.16 and earlier allow attackers with Overall/Read permission to connect to an FTP server using attacker-specified credentials.

AuthZ

A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over FTP Plugin 1.16 and earlier

CVE-2022-29050 8.8 - High - April 12, 2022

A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over FTP Plugin 1.16 and earlier allows attackers to connect to an FTP server using attacker-specified credentials.

Session Riding

Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL

CVE-2022-29049 4.3 - Medium - April 12, 2022

Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL, allowing attackers with Job/Configure permission to create a promotion with an unsafe name.

Improper Input Validation

A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier

CVE-2022-29048 4.3 - Medium - April 12, 2022

A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to connect to an attacker-specified URL.

Session Riding

Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3

CVE-2022-29047 5.3 - Medium - April 12, 2022

Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent), but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the definition of a dynamically retrieved library in their pull request, even if the Pipeline is configured to not trust them.

AuthZ

Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters

CVE-2022-29046 5.4 - Medium - April 12, 2022

Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

XSS

Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier

CVE-2022-29045 5.4 - Medium - April 12, 2022

Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not escape the name and description of Promoted Build parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

XSS

Jenkins Node and Label parameter Plugin 1.10.3 and earlier does not escape the name and description of Node and Label parameters on views displaying parameters

CVE-2022-29044 5.4 - Medium - April 12, 2022

Jenkins Node and Label parameter Plugin 1.10.3 and earlier does not escape the name and description of Node and Label parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

XSS

Jenkins Mask Passwords Plugin 3.0 and earlier does not escape the name and description of Non-Stored Password parameters on views displaying parameters

CVE-2022-29043 5.4 - Medium - April 12, 2022

Jenkins Mask Passwords Plugin 3.0 and earlier does not escape the name and description of Non-Stored Password parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

XSS

Jenkins Job Generator Plugin 1.22 and earlier does not escape the name and description of Generator Parameter and Generator Choice parameters on Job Generator jobs' Build With Parameters views

CVE-2022-29042 5.4 - Medium - April 12, 2022

Jenkins Job Generator Plugin 1.22 and earlier does not escape the name and description of Generator Parameter and Generator Choice parameters on Job Generator jobs' Build With Parameters views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

XSS

Jenkins Jira Plugin 3.7 and earlier

CVE-2022-29041 5.4 - Medium - April 12, 2022

Jenkins Jira Plugin 3.7 and earlier, except 3.6.1, does not escape the name and description of Jira Issue and Jira Release Version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

XSS

Jenkins Git Parameter Plugin 0.9.15 and earlier does not escape the name and description of Git parameters on views displaying parameters

CVE-2022-29040 5.4 - Medium - April 12, 2022

Jenkins Git Parameter Plugin 0.9.15 and earlier does not escape the name and description of Git parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

XSS

Jenkins Gerrit Trigger Plugin 2.35.2 and earlier does not escape the name and description of Base64 Encoded String parameters on views displaying parameters

CVE-2022-29039 5.4 - Medium - April 12, 2022

Jenkins Gerrit Trigger Plugin 2.35.2 and earlier does not escape the name and description of Base64 Encoded String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

XSS

Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the name and description of Extended Choice parameters on views displaying parameters

CVE-2022-29038 5.4 - Medium - April 12, 2022

Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the name and description of Extended Choice parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

XSS

Jenkins CVS Plugin 2.19 and earlier does not escape the name and description of CVS Symbolic Name parameters on views displaying parameters

CVE-2022-29037 5.4 - Medium - April 12, 2022

Jenkins CVS Plugin 2.19 and earlier does not escape the name and description of CVS Symbolic Name parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

XSS

Jenkins Credentials Plugin 1111.v35a_307992395 and earlier

CVE-2022-29036 5.4 - Medium - April 12, 2022

Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name and description of Credentials parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

XSS

Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier

CVE-2022-28156 6.5 - Medium - March 29, 2022

Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to copy arbitrary files and directories from the Jenkins controller to the agent workspace.

Directory traversal

Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier

CVE-2022-28157 6.5 - Medium - March 29, 2022

Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller via FTP to an attacker-specified FTP server.

Directory traversal

A missing permission check in Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier

CVE-2022-28158 6.5 - Medium - March 29, 2022

A missing permission check in Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

AuthZ

Jenkins Tests Selector Plugin 1.3.3 and earlier does not escape the Properties File Path option for Choosing Tests parameters

CVE-2022-28159 5.4 - Medium - March 29, 2022

Jenkins Tests Selector Plugin 1.3.3 and earlier does not escape the Properties File Path option for Choosing Tests parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

XSS

Jenkins Tests Selector Plugin 1.3.3 and earlier

CVE-2022-28160 6.5 - Medium - March 29, 2022

Jenkins Tests Selector Plugin 1.3.3 and earlier allows users with Item/Configure permission to read arbitrary files on the Jenkins controller.

Exposure of Resource to Wrong Sphere

Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not limit URL schemes for callback URLs on OAuth consumers

CVE-2022-28133 5.4 - Medium - March 29, 2022

Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not limit URL schemes for callback URLs on OAuth consumers, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create BitBucket Server consumers.

XSS

Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints

CVE-2022-28134 5.4 - Medium - March 29, 2022

Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to create, view, and delete BitBucket Server consumers.

AuthZ

A cross-site request forgery (CSRF) vulnerability in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier

CVE-2022-28138 4.3 - Medium - March 29, 2022

A cross-site request forgery (CSRF) vulnerability in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credential.

Session Riding

A missing permission check in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier

CVE-2022-28139 4.3 - Medium - March 29, 2022

A missing permission check in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.

AuthZ

Jenkins Proxmox Plugin 0.6.0 and earlier disables SSL/TLS certificate validation globally for the Jenkins controller JVM when configured to ignore SSL/TLS issues.

CVE-2022-28142 7.5 - High - March 29, 2022

Jenkins Proxmox Plugin 0.6.0 and earlier disables SSL/TLS certificate validation globally for the Jenkins controller JVM when configured to ignore SSL/TLS issues.

Improper Certificate Validation

Jenkins Flaky Test Handler Plugin 1.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVE-2022-28140 8.1 - High - March 29, 2022

Jenkins Flaky Test Handler Plugin 1.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

XXE

Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVE-2022-28155 8.1 - High - March 29, 2022

Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

XXE

Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVE-2022-28154 8.1 - High - March 29, 2022

Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

XXE

Jenkins SiteMonitor Plugin 0.6 and earlier does not escape URLs of sites to monitor in tooltips

CVE-2022-28153 5.4 - Medium - March 29, 2022

Jenkins SiteMonitor Plugin 0.6 and earlier does not escape URLs of sites to monitor in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

XSS

A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier

CVE-2022-28152 4.3 - Medium - March 29, 2022

A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to restore the default ownership of a job.

Session Riding

A missing permission check in Jenkins Job and Node ownership Plugin 0.13.0 and earlier

CVE-2022-28151 4.3 - Medium - March 29, 2022

A missing permission check in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers with Item/Read permission to change the owners and item-specific permissions of a job.

AuthZ

Jenkins Proxmox Plugin 0.5.0 and earlier stores the Proxmox Datacenter password unencrypted in the global config.xml file on the Jenkins controller where it

CVE-2022-28141 6.5 - Medium - March 29, 2022

Jenkins Proxmox Plugin 0.5.0 and earlier stores the Proxmox Datacenter password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

Insufficiently Protected Credentials

A missing permission check in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier

CVE-2022-28137 4.3 - Medium - March 29, 2022

A missing permission check in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.

Incorrect Permission Assignment for Critical Resource

A cross-site request forgery (CSRF) vulnerability in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier

CVE-2022-28136 8.8 - High - March 29, 2022

A cross-site request forgery (CSRF) vulnerability in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.

Session Riding

Jenkins instant-messaging Plugin 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins based on Jenkins instant-messaging Plugin on the Jenkins controller where they

CVE-2022-28135 6.5 - Medium - March 29, 2022

Jenkins instant-messaging Plugin 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins based on Jenkins instant-messaging Plugin on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

Jenkins Job and Node ownership Plugin 0.13.0 and earlier does not escape the names of the secondary owners

CVE-2022-28149 5.4 - Medium - March 29, 2022

Jenkins Job and Node ownership Plugin 0.13.0 and earlier does not escape the names of the secondary owners, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

XSS

A missing permission check in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier

CVE-2022-28147 4.3 - Medium - March 29, 2022

A missing permission check in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.

Improper Preservation of Permissions

Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier

CVE-2022-28146 6.5 - Medium - March 29, 2022

Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Item/Configure permission to read arbitrary files on the Jenkins controller by specifying an input folder on the Jenkins controller as a parameter to its build steps.

Directory traversal

Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier does not apply Content-Security-Policy headers to report files it serves

CVE-2022-28145 5.4 - Medium - March 29, 2022

Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier does not apply Content-Security-Policy headers to report files it serves, resulting in a stored cross-site scripting (XSS) exploitable by attackers with Item/Configure permission or otherwise able to control report contents.

XSS

Jenkins Proxmox Plugin 0.7.0 and earlier does not perform a permission check in several HTTP endpoints

CVE-2022-28144 6.5 - Medium - March 29, 2022

Jenkins Proxmox Plugin 0.7.0 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified host using attacker-specified username and password (perform a connection test), disable SSL/TLS validation for the entire Jenkins controller JVM as part of the connection test (see CVE-2022-28142), and test a rollback with attacker-specified parameters.

AuthZ

A cross-site request forgery (CSRF) vulnerability in Jenkins Proxmox Plugin 0.7.0 and earlier

CVE-2022-28143 6.5 - Medium - March 29, 2022

A cross-site request forgery (CSRF) vulnerability in Jenkins Proxmox Plugin 0.7.0 and earlier allows attackers to connect to an attacker-specified host using attacker-specified username and password (perform a connection test), disable SSL/TLS validation for the entire Jenkins controller JVM as part of the connection test (see CVE-2022-28142), and test a rollback with attacker-specified parameters.

Session Riding

A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier

CVE-2022-28150 8.8 - High - March 29, 2022

A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to change the owners and item-specific permissions of a job.

Session Riding

A missing/An incorrect permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier

CVE-2022-27211 6.5 - Medium - March 15, 2022

A missing/An incorrect permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

AuthZ

A missing permission check in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier

CVE-2022-27205 4.3 - Medium - March 15, 2022

A missing permission check in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Incorrect Default Permissions

Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller where it

CVE-2022-27206 6.5 - Medium - March 15, 2022

Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

Missing Encryption of Sensitive Data

Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page

CVE-2022-27207 4.8 - Medium - March 15, 2022

Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.

XSS

Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the value and description of extended choice parameters of radio buttons or check boxes type

CVE-2022-27202 5.4 - Medium - March 15, 2022

Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the value and description of extended choice parameters of radio buttons or check boxes type, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

XSS

Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier

CVE-2022-27203 6.5 - Medium - March 15, 2022

Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller.

Directory traversal

Jenkins Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form

CVE-2022-27200 4.8 - Medium - March 15, 2022

Jenkins Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.

XSS

Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier

CVE-2022-27208 6.5 - Medium - March 15, 2022

Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows users with Credentials/Create permission to read arbitrary files on the Jenkins controller.

Directory traversal

A cross-site request forgery (CSRF) vulnerability in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier

CVE-2022-27210 6.5 - Medium - March 15, 2022

A cross-site request forgery (CSRF) vulnerability in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Session Riding

A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier

CVE-2022-27199 4.3 - Medium - March 15, 2022

A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.

Incorrect Default Permissions

A cross-site request forgery (CSRF) vulnerability in Jenkins Release Helper Plugin 1.3.3 and earlier

CVE-2022-27214 4.3 - Medium - March 15, 2022

A cross-site request forgery (CSRF) vulnerability in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.

Session Riding

Jenkins List Git Branches Parameter Plugin 0.0.9 and earlier does not escape the name of the 'List Git branches (and more)' parameter

CVE-2022-27212 5.4 - Medium - March 15, 2022

Jenkins List Git Branches Parameter Plugin 0.0.9 and earlier does not escape the name of the 'List Git branches (and more)' parameter, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

XSS

Jenkins Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values in its views

CVE-2022-27213 5.4 - Medium - March 15, 2022

Jenkins Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values in its views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.

XSS

A missing permission check in Jenkins Release Helper Plugin 1.3.3 and earlier

CVE-2022-27215 4.3 - Medium - March 15, 2022

A missing permission check in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.

Improper Preservation of Permissions

Jenkins dbCharts Plugin 0.5.2 and earlier stores JDBC connection passwords unencrypted in its global configuration file on the Jenkins controller where they

CVE-2022-27216 6.5 - Medium - March 15, 2022

Jenkins dbCharts Plugin 0.5.2 and earlier stores JDBC connection passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

Insufficiently Protected Credentials

Jenkins Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they

CVE-2022-27217 6.5 - Medium - March 15, 2022

Jenkins Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

Insufficiently Protected Credentials

Jenkins incapptic connect uploader Plugin 1.15 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they

CVE-2022-27218 4.3 - Medium - March 15, 2022

Jenkins incapptic connect uploader Plugin 1.15 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

A cross-site request forgery (CSRF) vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier

CVE-2022-27198 8 - High - March 15, 2022

A cross-site request forgery (CSRF) vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.

Session Riding

Jenkins Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Jenkins Parameterized Trigger Plugin

CVE-2022-27195 5.5 - Medium - March 15, 2022

Jenkins Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Jenkins Parameterized Trigger Plugin, including password parameter values, in their `build.xml` files. These values are stored unencrypted and can be viewed by users with access to the Jenkins controller file system.

Insertion of Sensitive Information into Log File

Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column

CVE-2022-27196 5.4 - Medium - March 15, 2022

Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure or Item/Create permissions.

XSS

Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL

CVE-2022-27197 5.4 - Medium - March 15, 2022

Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure views.

XSS

A cross-site request forgery vulnerability in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier

CVE-2022-27204 8.8 - High - March 15, 2022

A cross-site request forgery vulnerability in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers to connect to an attacker-specified URL.

Session Riding

Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses distinct checkout directories per SCM for the readTrusted step

CVE-2022-25175 8.8 - High - February 15, 2022

Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses distinct checkout directories per SCM for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.

Shell injection

Jenkins Team Views Plugin 0.9.0 and earlier does not escape team names

CVE-2022-25203 5.4 - Medium - February 15, 2022

Jenkins Team Views Plugin 0.9.0 and earlier does not escape team names, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.

XSS

Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading the script file (typically Jenkinsfile) for Pipelines

CVE-2022-25176 6.5 - Medium - February 15, 2022

Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers able to configure Pipelines to read arbitrary files on the Jenkins controller file system.

insecure temporary file

Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected Pipeline library when reading files using the libraryResource step

CVE-2022-25177 6.5 - Medium - February 15, 2022

Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected Pipeline library when reading files using the libraryResource step, allowing attackers able to configure Pipelines to read arbitrary files on the Jenkins controller file system.

insecure temporary file

Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step

CVE-2022-25178 6.5 - Medium - February 15, 2022

Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system.

Directory traversal

Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading files using the readTrusted step

CVE-2022-25179 6.5 - Medium - February 15, 2022

Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading files using the readTrusted step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system.

insecure temporary file

Built by Foundeo Inc., with data from the National Vulnerability Database (NVD), Icons by Icons8. Privacy Policy. Use of this site is governed by the Legal Terms
Disclaimer
CONTENT ON THIS WEBSITE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. Always check with your vendor for the most up to date, and accurate information.