Jenkins Scriptler
By the Year
In 2024 there have been 0 vulnerabilities in Jenkins Scriptler . Last year Scriptler had 2 security vulnerabilities published. Right now, Scriptler is on track to have less security vulnerabilities in 2024 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 0 | 0.00 |
| 2023 | 2 | 6.20 |
| 2022 | 0 | 0.00 |
| 2021 | 3 | 5.40 |
| 2020 | 0 | 0.00 |
| 2019 | 0 | 0.00 |
| 2018 | 0 | 0.00 |
It may take a day or so for new Scriptler vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Jenkins Scriptler Security Vulnerabilities
A missing permission check in Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier
CVE-2023-50765
4.3 - Medium
- December 13, 2023
A missing permission check in Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier allows attackers with Overall/Read permission to read the contents of a Groovy script by knowing its ID.
AuthZ
Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier does not restrict a file name query parameter in an HTTP endpoint
CVE-2023-50764
8.1 - High
- December 13, 2023
Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing attackers with Scriptler/Configure permission to delete arbitrary files on the Jenkins controller file system.
Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion
CVE-2021-21700
5.4 - Medium
- November 12, 2021
Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by exploitable by attackers able to create Scriptler scripts.
XSS
Jenkins Scriptler Plugin 3.1 and earlier does not escape script content
CVE-2021-21668
5.4 - Medium
- June 16, 2021
Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.
XSS
Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms
CVE-2021-21667
5.4 - Medium
- June 16, 2021
Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.
XSS
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Jenkins Scriptler or by Jenkins? Click the Watch button to subscribe.
