plugin: Lack of authentication mechanism in Git Plugin webhook

The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an attacker-specified Git repository...

plugin: Lack of authentication mechanism in Git Plugin webhook

A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit...

plugin: Lack of authentication mechanism in Git Plugin webhook

The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an attacker-specified Git repository...

plugin: Lack of authentication mechanism in Git Plugin webhook

A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit...

The vulnerability of the Webhook Endpoint component of the Jenkins Git Plugin, related to the disclosure of information, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Webhook Endpoint component of the Jenkins Git Plugin relates to the disclosure of information. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Build Handler component of the Jenkins Git plugin allows a perpetrator to perform arbitrary actions on a vulnerable device.

The vulnerability of the Build Handler component in the Jenkins Git plugin is related to insufficient validation of the authenticity of executed requests. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on the vulnerable device by manipulating the requests made...

Jenkins Enterprise and Operations Center 2.303.x < 2.303.30.0.15 / 2.346.2.3 Multiple Vulnerabilities (CloudBees Security Advisory 2022-07-27)

The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.303.x prior to 2.303.30.0.15, or 2.x prior to 2.346.2.3. It is, therefore, affected by multiple vulnerabilities, including the following: - A cross-site request forgery CSRF vulnerability in Jenki...

The vulnerability of the Build Handler component of the Jenkins Git plugin, related to authentication errors, allows a hacker to circumvent established security restrictions and gain increased privileges.

The vulnerability of the Build Handler component in the Jenkins Git plugin is related to authentication errors. Exploiting this vulnerability allows a malicious actor to bypass established security restrictions and gain increased privileges...

CVE-2022-38663

A flaw was found in the Jenkins Git plugin. The Git Plugin does not properly mask the credentials in the build log provided by the Git Username and Password gitUsernamePassword credentials binding. Usernames are masked instead of passwords in cases when usernames are not set to be treated as secr...

org.jenkins-ci.plugins:git-bisect (>=1.0, <=1.3) potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (2.6.0)

org.jenkins-ci.plugins:git MAVEN version 2.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:git-bisect =1.0, =1.3 Source cves: CVE-2022-38663 Source advisory:...

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (2.0.0-beta-1), org.jenkins-ci.plugins:github-branch-source (2.0.0-beta-2) +1 more potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (2.6.2-beta-2)

org.jenkins-ci.plugins:git MAVEN version 2.6.2-beta-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source 2.0.0-beta-1 -...

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (2.0.2), org.jenkins-ci.plugins:github-branch-source (>=2.0.1, <=2.0.8) +2 more potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (2.6.4)

org.jenkins-ci.plugins:git MAVEN version 2.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source 2.0.2 - org.jenkins-ci.plugins:github-branch-sourc...

com.coravy.hudson.plugins.github:github (>=1.9, <=1.13.3), com.elasticbox.jenkins-ci.plugins:elasticbox (>=4.0.9, <=4.1.0) +4 more potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (2.0)

org.jenkins-ci.plugins:git MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - com.coravy.hudson.plugins.github:github =1.9, =4.0.9, =0.9.14, =1.8, =1.4.0, =1.4.2 Source cves: CVE-2022-386...

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (>=2.1.0, <=2.1.2) potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (2.6.5)

org.jenkins-ci.plugins:git MAVEN version 2.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source =2.1.0, =2.1.2 Source cves: CVE-2022-38663 Source...

org.jenkins-ci.tools:git-parameter (0.9.7) potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (3.9.1)

org.jenkins-ci.plugins:git MAVEN version 3.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.tools:git-parameter 0.9.7 Source cves: CVE-2022-38663 Source advisory: OSV:GHSA-JXMW-3GXF-FP...

org.jenkins-ci.plugins:github-branch-source (2.0.0-beta-1), org.jenkins-ci.plugins:github-organization-folder (1.6-beta-1) +1 more potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (2.6.2-beta-1)

org.jenkins-ci.plugins:git MAVEN version 2.6.2-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:github-branch-source 2.0.0-beta-1 -...

org.jenkins-ci.plugins:bitbucket-approve (>=1.0.1, <=1.0.3) potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (2.2.10)

org.jenkins-ci.plugins:git MAVEN version 2.2.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:bitbucket-approve =1.0.1, =1.0.3 Source cves: CVE-2022-38663 Source advisory:...

io.jenkins.blueocean:blueocean (>=1.1.0-beta-2, <=1.2.0-beta-1), io.jenkins.blueocean:blueocean-events (>=1.1.0-beta-2, <=1.2.0-beta-1) +4 more potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (3.3.0)

org.jenkins-ci.plugins:git MAVEN version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - io.jenkins.blueocean:blueocean =1.1.0-beta-2, =1.1.0-beta-2, =1.1.0-beta-2, =1.1.0-beta-2, =1.1.0-beta-2,...

org.jenkins-ci.plugins:github-branch-source (>=0.1-beta-1, <=1.10.1), org.jenkins-ci.plugins:github-organization-folder (>=1.0-beta-1, <=1.5) +2 more potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (2.3)

org.jenkins-ci.plugins:git MAVEN version 2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:github-branch-source =0.1-beta-1, =1.0-beta-1, =1.0, =1.0.0, =1.0.3 Source cves:...

org.jenkins-ci.plugins:assembla-merge-request-builder (>=1.1.1, <=1.1.13), org.jenkins-ci.plugins:bitbucket-pullrequest-builder (>=1.4.6, <=1.4.28) +2 more potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (2.2.4)

org.jenkins-ci.plugins:git MAVEN version 2.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:assembla-merge-request-builder =1.1.1, =1.4.6, =1.13-1, =1.1.1, =1.4.2 Source cves:...