CVE-2022-46688

A cross-site request forgery CSRF vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have Jenkins connect to Gerrit servers previously configured by Jenkins administrators using attacker-specified credentials IDs obtained through another method,...

PT-2022-27952 · Jenkins · Jenkins Sonar Gerrit Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Sonar Gerrit Plugin versions 377.v8f3808963dc5 and earlier Description: A cross-site request forgery CSRF issue allows attackers to have Jenkins connect to Gerrit servers using attacker-specified credentials IDs, potentially capturing...

CVE-2022-46688

A cross-site request forgery CSRF vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have Jenkins connect to Gerrit servers previously configured by Jenkins administrators using attacker-specified credentials IDs obtained through another method,...

com.gerritforge:global-refdb (=3.2.3) potentially affected by CVE-2020-8920 via com.google.gerrit:gerrit-plugin-api (=3.2.3)

com.google.gerrit:gerrit-plugin-api MAVEN version =3.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.gerrit:gerrit-plugin-api and may be impacted: - com.gerritforge:global-refdb =3.2.3 Source cves: CVE-2020-8920 Source advisory:...

Information leak in Gerrit

An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the FilteredRepository wrapper skips the verification of access on All-Users repositories, allowing an attacker to get read access to all users'...

GHSA-G5Q2-CXGQ-H2RW Information leak in Gerrit

An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the FilteredRepository wrapper skips the verification of access on All-Users repositories, allowing an attacker to get read access to all users'...

org.jenkins-ci.plugins:gerrit-verify-status-reporter (>=0.0.2 <=0.0.3), org.jenkins-ci.plugins:msginject (>=0.1.0 <=0.1.1) +1 more potentially affected by CVE-2019-16552 via com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger (>=2.14.0 <=2.22.0)

com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger MAVEN version =2.14.0, =0.0.2, =0.1.0, =1.0, =2.4.6 Source cves: CVE-2019-16552 Source advisory: OSV:GHSA-4R39-F4RH-J6Q8...

org.jenkins-ci.plugins:gerrit-verify-status-reporter (>=0.0.2 <=0.0.3), org.jenkins-ci.plugins:msginject (>=0.1.0 <=0.1.1) +1 more potentially affected by CVE-2019-16551 via com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger (>=2.14.0 <=2.22.0)

com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger MAVEN version =2.14.0, =0.0.2, =0.1.0, =1.0, =2.4.6 Source cves: CVE-2019-16551 Source advisory: OSV:GHSA-VMVP-2HHX-RGM8...

Missing permission check in Jenkins Gerrit Trigger Plugin

A missing permission check in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials, or determine the existence of a file with a given path on the Jenkins maste...

Cross-Site Request Forgery in Jenkins Gerrit Trigger Plugin

A cross-site request forgery vulnerability in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials...

GHSA-4R39-F4RH-J6Q8 Missing permission check in Jenkins Gerrit Trigger Plugin

A missing permission check in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials, or determine the existence of a file with a given path on the Jenkins maste...

GHSA-VMVP-2HHX-RGM8 Cross-Site Request Forgery in Jenkins Gerrit Trigger Plugin

A cross-site request forgery vulnerability in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials...

GHSA-6FV3-W7J6-5XFC Jenkins Sonar Gerrit Plugin stores credentials unencrypted

Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

Jenkins Sonar Gerrit Plugin stores credentials unencrypted

Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

org.jenkins-ci.plugins:sonar-gerrit (=428.v5c962d271b_a_5) potentially affected by CVE-2013-5676 via org.jenkins-ci.plugins:sonar (=2.13.1)

org.jenkins-ci.plugins:sonar MAVEN version =2.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:sonar and may be impacted: - org.jenkins-ci.plugins:sonar-gerrit =428.v5c962d271ba5 Source cves: CVE-2013-5676 Source advisory:...

org.jenkins-ci.plugins:gerrit-verify-status-reporter (>=0.0.2 <=0.0.3), org.jenkins-ci.plugins:msginject (>=0.1.0 <=0.1.1) +1 more potentially affected by CVE-2018-1000106 via com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger (>=2.14.0 <=2.22.0)

com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger MAVEN version =2.14.0, =0.0.2, =0.1.0, =1.0, =2.4.6 Source cves: CVE-2018-1000106 Source advisory: OSV:GHSA-4VF2-CM23-RF4C...

org.jenkins-ci.plugins:gerrit-verify-status-reporter (>=0.0.2 <=0.0.3), org.jenkins-ci.plugins:msginject (>=0.1.0 <=0.1.1) +1 more potentially affected by CVE-2018-1000105 via com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger (>=2.14.0 <=2.22.0)

com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger MAVEN version =2.14.0, =0.0.2, =0.1.0, =1.0, =2.4.6 Source cves: CVE-2018-1000105 Source advisory: OSV:GHSA-WRQC-Q8P5-76M5...

Incorrect Authorization in Jenkins Gerrit Trigger Plugin

An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.java, and PluginImpl.java that allows an attacker with Overall/Read access to retrieve some configuration information about Gerrit in Jenkins...

Incorrect Authorization in Jenkins Gerrit Trigger Plugin

An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.java, and PluginImpl.java that allows an attacker with Overall/Read access to modify the Gerrit configuration in Jenkins...

GHSA-WRQC-Q8P5-76M5 Incorrect Authorization in Jenkins Gerrit Trigger Plugin

An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.java, and PluginImpl.java that allows an attacker with Overall/Read access to retrieve some configuration information about Gerrit in Jenkins...