CVE-2020-2255

A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL...

CVE-2020-2255

A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL...

CVE-2020-2254

Jenkins Blue Ocean Plugin 1.23.2 and earlier provides an undocumented feature flag that, when enabled, allows an attacker with Job/Configure or Job/Create permission to read arbitrary files on the Jenkins controller file system...

CVE-2020-2255

A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL...

Design/Logic Flaw

Jenkins Blue Ocean Plugin 1.23.2 and earlier provides an undocumented feature flag that, when enabled, allows an attacker with Job/Configure or Job/Create permission to read arbitrary files on the Jenkins controller file system...

Information disclosure

A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL...

CVE-2020-2255

A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL...

CVE-2020-2255

CVE-2020-2255: Jenkins Blue Ocean Plugin 1.23.2 and earlier has a missing permission check in HTTP endpoints used for connection tests. This allows attackers with Overall/Read permission to connect to an attacker-specified URL from the vulnerable instance. The issue is documented across multiple ...

CVE-2020-2254

CVE-2020-2254 affects Jenkins Blue Ocean Plugin 1.23.2 and earlier. An undocumented feature flag, blueocean.features.GIT_READ_SAVE_TYPE, when set to clone, allows an attacker with Job/Configure or Job/Create permissions to read arbitrary files on the Jenkins controller filesystem. The issue is a ...

PT-2019-11311 · Jenkins · Jenkins Blue Ocean Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Blue Ocean Plugins versions 1.10.1 and earlier Description: A cross-site scripting issue exists that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as th...

PT-2019-11310 · Jenkins · Jenkins Blue Ocean Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Blue Ocean Plugins versions 1.10.1 and earlier Description: A data modification issue exists that allows attackers to bypass all cross-site request forgery protection in the Blue Ocean API. The vulnerability is found in several files,...

CloudBees Jenkins Blue Ocean Plugin Security Bypass Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . A...