io.jenkins.blueocean:blueocean-git-pipeline (>=1.2.0-beta-5, <=1.2.4), io.jenkins.blueocean:blueocean-pipeline-scm-api (>=1.2.0-beta-5, <=1.3.6) +2 more potentially affected by CVE-2022-30945 via org.jenkins-ci.plugins.workflow:workflow-cps (2.39)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.39 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.jenkins.blueocean:blueocean-git-pipeline =1.2.0-beta-5, =1.2.0-beta-5...

io.jenkins.blueocean:blueocean (>=1.1.0-beta-4, <=1.2.0-beta-1), io.jenkins.blueocean:blueocean-events (>=1.1.0-beta-4, <=1.2.0-beta-1) +4 more potentially affected by CVE-2022-30952 via io.jenkins.blueocean:blueocean-pipeline-scm-api (>=1.1.0-beta-4, <=1.2.4)

io.jenkins.blueocean:blueocean-pipeline-scm-api MAVEN version =1.1.0-beta-4, =1.1.0-beta-4, =1.1.0-beta-4, =1.1.0-beta-4, =1.1.0-beta-4, =1.1.0-beta-4, =0.3.0-beta-1, =0.3.0-beta-4 Source cves: CVE-2022-30952 Source advisory: MEND:CVE-2022-30952...

CVE-2022-30952: Insufficiently Protected Credentials

Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins...

Improper Authentication in Jenkins Blue Ocean Plugin

Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. Its SCM content REST API supports the pipeline creation and editing feature in Blue...

Information Disclosure

maven-scm-api is vulnerable to information disclosure attacks. If a git push command failed, the password is printed in plaintext to the logs...