XXE vulnerability in rapiddeploy-jenkins

rapiddeploy-jenkins 4.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows a user able to control the input files for the 'RapidDeploy deployment package build' build or post-build step to have Jenkins parse a crafted file that uses external...

Stored XSS vulnerability in rapiddeploy-jenkins

rapiddeploy-jenkins 4.2 and earlier does not escape package names in its displayed table of packages obtained from a remote server. This results in a stored cross-site scripting XSS vulnerability exploitable by users able to configure jobs. rapiddeploy-jenkins 4.2.1 escapes package names...

CSRF vulnerability and missing permission checks in rapiddeploy-jenkins allow SSRF

rapiddeploy-jenkins 4.1 and earlier does not perform a permission check on form validation methods. This allows users with Overall/Read access to Jenkins to connect to RapidDeploy-related paths on an attacker-specified web server. Additionally, these form validation methods do not require POST...