CVE-2018-1000422

An improper authorization vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java that allows attackers to have Jenkins perform a connection test, connecting to an attacker-specified server with attacker-specified credentials and connection settings...

CVE-2018-1000423

An insufficiently protected credentials vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java, CrowdConfigurationService.java that allows attackers with local file system access to obtain the credentials used to connect to Crowd 2...

PT-2019-8734

Name of the Vulnerable Software and Affected Versions Jenkins Crowd 2 Integration Plugin versions 2.0.0 and earlier Description An issue exists where credentials are not sufficiently protected, allowing attackers with local file system access to obtain the credentials used to connect to Crowd 2...

PT-2019-8733

Name of the Vulnerable Software and Affected Versions Jenkins Crowd 2 Integration Plugin versions 2.0.0 and earlier Description An improper authorization issue exists in the CrowdSecurityRealm.java file, allowing attackers to perform a connection test. This test connects to an attacker-specified...

CVE-2018-1000423: Insufficiently Protected Credentials

An insufficiently protected credentials vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java, CrowdConfigurationService.java that allows attackers with local file system access to obtain the credentials used to connect to Crowd 2...

CVE-2018-1000422: Server-Side Request Forgery (SSRF)

An improper authorization vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java that allows attackers to have Jenkins perform a connection test, connecting to an attacker-specified server with attacker-specified credentials and connection settings...