jenkins-plugins: cloudbees-folder: CSRF vulnerability in Folders Plugin

A flaw was found in the Jenkins Folders plugin. Affected versions of this plugin allow attackers to copy a view inside a folder...

Information Disclosure

org.jenkins-ci.plugins, cloudbees-folder is vulnerable to Information Disclosure. The vulnerability exists because the library does not properly restrict the organization folder log file location, which allows an attacker to gain access to sensitive information in the system...

org.jenkins-ci.plugins:job-dsl (>=1.29, <=1.32) potentially affected by CVE-2023-40337 via org.jenkins-ci.plugins:cloudbees-folder (4.4)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 4.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - org.jenkins-ci.plugins:job-dsl =1.29, =1.32 Source cves: CVE-2023-40337 Source...

org.jenkins-ci.plugins.workflow:workflow-multibranch (>=1.11-beta-2, <=1.11-beta-3), org.jenkins-ci.plugins:branch-api (>=0.2-beta-6, <=0.2-beta-7) potentially affected by CVE-2023-40338 via org.jenkins-ci.plugins:cloudbees-folder (5.1-beta-1)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 5.1-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-multibranch =1.11-beta-2,...

org.jenkins-ci.plugins:radiatorviewplugin (>=1.28, <=1.29), org.jenkins-ci.plugins:security-inspector (0.3) potentially affected by CVE-2023-40336 via org.jenkins-ci.plugins:cloudbees-folder (5.13)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 5.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - org.jenkins-ci.plugins:radiatorviewplugin =1.28, =1.29 -...

com.amadeus.jenkins.plugins:workflow-cps-global-lib-http (>=2.33.0, <=2.54.0), com.datapipe.jenkins.plugins:hashicorp-vault-plugin (>=2.0.0, <=2.2.0) +46 more potentially affected by CVE-2023-40336 via org.jenkins-ci.plugins:cloudbees-folder (>=6.0.1, <=6.815.v0dd5a_cb_40e0e)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version =6.0.1, =2.33.0, =2.0.0, =7.5.7, =1.0.31, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =0.2.0, =1.1.0-beta-4, =1.27.11 and more Source cves: CVE-2023-40336 Source advisory:...

io.jenkins.blueocean:blueocean (>=1.0-alpha-3, <=1.0.0-b11), io.jenkins.blueocean:blueocean-dashboard (>=1.0-alpha-3, <=1.0.0-b11) +13 more potentially affected by CVE-2023-40336 via org.jenkins-ci.plugins:cloudbees-folder (5.10)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 5.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - io.jenkins.blueocean:blueocean =1.0-alpha-3, =1.0-alpha-3, =1.0-alpha-3,...

io.jenkins.blueocean:blueocean-github-pipeline (1.0.0-b19-beta-1), org.jenkins-ci.plugins.workflow:workflow-multibranch (>=2.10, <=2.11-beta-1) +2 more potentially affected by CVE-2023-40338 via org.jenkins-ci.plugins:cloudbees-folder (5.16)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 5.16 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - io.jenkins.blueocean:blueocean-github-pipeline 1.0.0-b19-beta-1 -...

org.jenkins-ci.plugins:job-dsl (>=1.29, <=1.32) potentially affected by CVE-2023-40336 via org.jenkins-ci.plugins:cloudbees-folder (4.4)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 4.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - org.jenkins-ci.plugins:job-dsl =1.29, =1.32 Source cves: CVE-2023-40336 Source...

com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin (>=0.6, <=0.7), io.jenkins.blueocean:blueocean (>=1.0.0-b22, <=1.0.0-b24) +12 more potentially affected by CVE-2023-40337 via org.jenkins-ci.plugins:cloudbees-folder (5.17)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 5.17 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin =0.6, =1.0.0-b22...

com.amadeus.jenkins.plugins:workflow-cps-global-lib-http (>=2.33.0, <=2.54.0), com.datapipe.jenkins.plugins:hashicorp-vault-plugin (>=2.0.0, <=2.2.0) +46 more potentially affected by CVE-2023-40338 via org.jenkins-ci.plugins:cloudbees-folder (>=6.0.1, <=6.815.v0dd5a_cb_40e0e)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version =6.0.1, =2.33.0, =2.0.0, =7.5.7, =1.0.31, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =0.2.0, =1.1.0-beta-4, =1.27.11 and more Source cves: CVE-2023-40338 Source advisory:...

org.jenkins-ci.plugins:vsphere-cloud (>=2.15, <=2.21) potentially affected by CVE-2023-40336 via org.jenkins-ci.plugins:cloudbees-folder (5.2.2)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 5.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - org.jenkins-ci.plugins:vsphere-cloud =2.15, =2.21 Source cves: CVE-2023-40336...

com.compuware.jenkins:compuware-scm-downloader (>=1.6, <=2.0.5), com.compuware.jenkins:compuware-topaz-for-total-test (>=1.8, <=2.3.7) +31 more potentially affected by CVE-2023-40338 via org.jenkins-ci.plugins:cloudbees-folder (5.12)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 5.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - com.compuware.jenkins:compuware-scm-downloader =1.6, =1.8, =1.0.2, =1.0.0,...

com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin (>=0.6, <=0.7), io.jenkins.blueocean:blueocean (>=1.0.0-b22, <=1.0.0-b24) +12 more potentially affected by CVE-2023-40336 via org.jenkins-ci.plugins:cloudbees-folder (5.17)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 5.17 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin =0.6, =1.0.0-b22...

com.amadeus.jenkins.plugins:workflow-cps-global-lib-http (>=2.33.0, <=2.54.0), com.datapipe.jenkins.plugins:hashicorp-vault-plugin (>=2.0.0, <=2.2.0) +46 more potentially affected by CVE-2023-40337 via org.jenkins-ci.plugins:cloudbees-folder (>=6.0.1, <=6.815.v0dd5a_cb_40e0e)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version =6.0.1, =2.33.0, =2.0.0, =7.5.7, =1.0.31, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =0.2.0, =1.1.0-beta-4, =1.27.11 and more Source cves: CVE-2023-40337 Source advisory:...

org.jenkins-ci.plugins:job-dsl (1.19) potentially affected by CVE-2023-40337 via org.jenkins-ci.plugins:cloudbees-folder (4.0)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - org.jenkins-ci.plugins:job-dsl 1.19 Source cves: CVE-2023-40337 Source advisory:...

io.jenkins.blueocean:blueocean (>=1.0.0-b19-beta-1, <=1.0.0-b21-beta-1), io.jenkins.blueocean:blueocean-config (>=1.0.0-b19-beta-1, <=1.0.0-b21-beta-1) +8 more potentially affected by CVE-2023-40336 via org.jenkins-ci.plugins:cloudbees-folder (5.17-beta-1)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 5.17-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - io.jenkins.blueocean:blueocean =1.0.0-b19-beta-1, =1.0.0-b19-beta-1,...

org.jenkins-ci.plugins:job-dsl (>=1.20, <=1.28) potentially affected by CVE-2023-40338 via org.jenkins-ci.plugins:cloudbees-folder (4.2)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 4.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - org.jenkins-ci.plugins:job-dsl =1.20, =1.28 Source cves: CVE-2023-40338 Source...

org.jenkins-ci.plugins:job-dsl (>=1.20, <=1.28) potentially affected by CVE-2023-40337 via org.jenkins-ci.plugins:cloudbees-folder (4.2)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 4.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - org.jenkins-ci.plugins:job-dsl =1.20, =1.28 Source cves: CVE-2023-40337 Source...

org.jenkins-ci.plugins:seed (>=0.8.0, <=0.20.0) potentially affected by CVE-2023-40337 via org.jenkins-ci.plugins:cloudbees-folder (4.7)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 4.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - org.jenkins-ci.plugins:seed =0.8.0, =0.20.0 Source cves: CVE-2023-40337 Source...