CloudBees Jenkins Team Concert Plugin Authorization Issue Vulnerability (CNVD-2020-11656)

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . An authorization issue vulnerability exists in the methods related to forms in CloudBees Jenkins Team Concert Plugin 1.3.0 and prior versions. The vulnerability...

CloudBees Jenkins Team Concert Plugin Cross-Site Request Forgery Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site request forgery...

CVE-2019-16566

A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2019-16565

A cross-site request forgery vulnerability in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2019-16566

A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2019-16565

A cross-site request forgery vulnerability in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

Cross site request forgery (csrf)

A cross-site request forgery vulnerability in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2019-16567

CVE-2019-16567 affects Jenkins Team Concert Plugin 1.3.0 and earlier. A missing permission check in form-related methods lets users with Overall/Read access enumerate credential IDs stored in Jenkins. Impact: credential enumeration; no exploitation details provided. Mitigation: upgrade/patch to a...

CVE-2019-16567

A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins...

CVE-2019-16566

CVE-2019-16566 affects Jenkins Team Concert Plugin versions 1.3.0 and earlier. The root cause is a missing permission check in a form/URL handling path that allows attackers with Overall/Read access to initiate connections to an attacker-specified URL using attacker-specified credentials IDs, ena...

CVE-2019-16565

Jenkins Team Concert Plugin 1.3.0 and earlier is vulnerable to cross‑site request forgery due to missing permission checks on a form validation method. This flaw allows an attacker with some Jenkins access to cause the server to connect to an attacker‑supplied URL using attacker‑supplied credenti...

CVE-2019-16566

A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

PT-2019-14721 · Jenkins · Jenkins Team Concert Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Team Concert Plugin versions 1.3.0 and earlier Description: A missing permission check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs,...