dynatrace-dashboard stored credentials in plain text

dynatrace-dashboard stored a credential unencrypted in its global configuration file com.dynatrace.jenkins.dashboard.TAGlobalConfiguration.xml on the Jenkins controller. This credential could be viewed by users with access to the Jenkins controller file system. dynatrace-dashboard now stores this...

CSRF vulnerability in dynatrace-dashboard

dynatrace-dashboard did not require POST requests on a method implementing form validation. This CSRF vulnerability allowed attackers to initiate a connection test to an attacker-specified server with attacker-specified username and password. dynatrace-dashboard now requires POST requests for thi...

Missing permission check in dynatrace-dashboard

dynatrace-dashboard does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to initiate a connection test to an attacker-specified server with attacker-specified username and password. As of publication of this advisory,...