Security feature bypass

A missing permission check in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method...

Cross site request forgery (csrf)

A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method...

CVE-2020-2090

The CVE-2020-2090 entry pertains to a CSRF vulnerability in Jenkins Amazon EC2 Plugin (versions 1.47 and earlier). The root cause is that form validation methods did not perform permission checks, allowing users with Overall/Read access to Jenkins to connect to an attacker-specified URL within th...

CVE-2020-2091

CVE-2020-2091 concerns the Jenkins Amazon EC2 Plugin (versions 1.47 and earlier). A missing permission check in form validation allows users with Overall/Read access to connect to an attacker-specified URL in the AWS region using attacker-specified credentials IDs obtained via another method. The...

PT-2020-15297 · Jenkins · Jenkins Amazon Ec2 Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Amazon EC2 Plugin versions 1.47 and earlier Description: A missing permission check in the Jenkins Amazon EC2 Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL within the AWS region using...

PT-2020-15296 · Jenkins · Jenkins Amazon Ec2 Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Amazon EC2 Plugin versions 1.47 and earlier Description: A cross-site request forgery issue allows attackers to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through anoth...

CVE-2020-2091

A missing permission check in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method...

Code injection

Jenkins Amazon EC2 Plugin 1.43 and earlier wrote the beginning of private keys to the Jenkins system log...

CVE-2019-10364

CVE-2019-10364 affects the Jenkins Amazon EC2 Plugin up to and including version 1.43. The issue arises because the plugin writes the beginning of private keys to the Jenkins system log, which could expose sensitive information. The Red Hat and PT-Security entries corroborate this behavior and no...

CloudBees Jenkins EC2 Plugin Arbitrary Command Execution Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . An...