CVE-2025-52491

CVE-2025-52491 affects Akamai CloudTest prior to version 60 2025.06.09 (12989) and allows server-side request forgery (SSRF). The NVD entry lists CVSS 3.1 base score 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N). Connected sources confirm the affected release and remediation guidance; PT-2025-27471 r...

CVE-2025-49493

Akamai CloudTest before 60 2025.06.02 12988 allows file inclusion via XML External Entity XXE injection...

CVE-2025-49493

Akamai CloudTest before 60 2025.06.02 (12988) is affected by an XXE injection in SOAP endpoints (e.g., RepositoryService). The flaw can allow unauthenticated reading of local files; CVSS v3.1: 9.1. Remediation: upgrade to CloudTest 60 2025.06.02 (12988) or later, which disables external entity pr...

CVE-2025-49493

Akamai CloudTest before 60 2025.06.02 12988 allows file inclusion via XML External Entity XXE injection...

CVE-2025-49493: Improper Restriction of XML External Entity Reference

Akamai CloudTest before 60 2025.06.02 12988 allows file inclusion via XML External Entity XXE injection...

PT-2025-27471 · Akamai · Akamai Cloudtest

Name of the Vulnerable Software and Affected Versions: Akamai CloudTest versions prior to 60 2025.06.09 Description: The issue allows for Server-Side Request Forgery SSRF, which is a type of attack where an attacker can trick a server into making requests to internal or external resources. No...

CVE-2025-52491

Akamai CloudTest before 60 2025.06.09 12989 allows SSRF...

PT-2025-27467 · Akamai · Akamai Cloudtest

Name of the Vulnerable Software and Affected Versions: Akamai CloudTest versions prior to 60 2025.06.02 12988 Description: Akamai CloudTest is susceptible to an XML External Entity XXE injection flaw. This allows for file inclusion by manipulating XML input, potentially leading to unauthorized...

CVE-2019-1003090

A cross-site request forgery vulnerability in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpldoValidate form validation method allows attackers to initiate a connection to an attacker-specified server...

CVE-2019-10451

Jenkins SOASTA CloudTest Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

CVE-2019-1003091

A missing permission check in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpldoValidate form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...

Running CloudTest on Akamai Cloud Computing

...

com.soasta.jenkins:cloudtest (>=2.22, <=2.25), jenkins.plugins.office365connector:office-365-connector (>=1.0.6, <=1.0.10) +6 more potentially affected by CVE-2022-45380 via org.jenkins-ci.plugins:junit (1.5)

org.jenkins-ci.plugins:junit MAVEN version 1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:junit and may be impacted: - com.soasta.jenkins:cloudtest =2.22, =1.0.6, =2.7, =2020.2, =1.1, =1.0.0, =1.0, =1.0, =1.3 Source cves:...

Jenkins SOASTA CloudTest Plugin stores API token in plain text

Jenkins SOASTA CloudTest Plugin stores credentials unencrypted in its global configuration file com.soasta.jenkins.CloudTestServer.xml on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system. As of publication of this advisory there ...

GHSA-7HP3-5W4X-8F7C Jenkins SOASTA CloudTest Plugin stores API token in plain text

Jenkins SOASTA CloudTest Plugin stores credentials unencrypted in its global configuration file com.soasta.jenkins.CloudTestServer.xml on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system. As of publication of this advisory there ...

com.cloudbees.jenkins.plugins:xpdev (1.0), com.cloudbees.plugins:build-flow-plugin (0.4) +50 more potentially affected by CVE-2019-10384 via org.jenkins-ci.main:jenkins-core (1.447)

org.jenkins-ci.main:jenkins-core MAVEN version 1.447 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.jenkins.plugins:xpdev 1.0 - com.cloudbees.plugins:build-flow-plugin 0.4 -...

com.cloudbees.jenkins.plugins:xpdev (1.0), com.cloudbees.plugins:build-flow-plugin (0.4) +50 more potentially affected by CVE-2019-10352 via org.jenkins-ci.main:jenkins-core (1.447)

org.jenkins-ci.main:jenkins-core MAVEN version 1.447 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.jenkins.plugins:xpdev 1.0 - com.cloudbees.plugins:build-flow-plugin 0.4 -...

GHSA-23R7-HF6G-QQQG CSRF vulnerability in Jenkins SOASTA CloudTest Plugin

A cross-site request forgery vulnerability in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpldoValidate form validation method allows attackers to initiate a connection to an attacker-specified server...

CSRF vulnerability in Jenkins SOASTA CloudTest Plugin

A cross-site request forgery vulnerability in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpldoValidate form validation method allows attackers to initiate a connection to an attacker-specified server...

GHSA-FHGG-J92H-29RC Missing permission check in Jenkins SOASTA CloudTest Plugin

A missing permission check in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpldoValidate form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...