com.amazon.jenkins.fleet:ec2-fleet (>=1.0, <=1.17.3), com.cloudbees.jenkins.plugins:amazon-ecr (1.6) +50 more potentially affected by CVE-2022-20616 via org.jenkins-ci.plugins:credentials-binding (>=1.7, <=1.24)

org.jenkins-ci.plugins:credentials-binding MAVEN version =1.7, =1.0, =1.4, =0.17, =1.0.43, =1.0.0-b13, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =1.2.0-beta-1 and more Source cves: CVE-2022-20616 Source advisory: GHSA-GQM2-2GCX-P88W...

CVE-2022-20616

Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file...

CVE-2022-20616

Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file...

CVE-2022-20616

Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file...

CVE-2022-20616

CVE-2022-20616 refers to the Jenkins Credentials Binding Plugin (version ≤ 1.27) where a missing permission check in the form-validation method allows users with Overall/Read access to determine whether a given credential ID points to a secret file credential and whether it is a ZIP file. The des...

CVE-2022-20616

Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file...

com.amazon.jenkins.fleet:ec2-fleet (>=1.0, <=1.17.3), com.cloudbees.jenkins.plugins:amazon-ecr (1.6) +50 more potentially affected by CVE-2022-20616 via org.jenkins-ci.plugins:credentials-binding (>=1.7, <=1.24)

org.jenkins-ci.plugins:credentials-binding MAVEN version =1.7, =1.0, =1.4, =0.17, =1.0.43, =1.0.0-b13, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =1.2.0-beta-1 and more Source cves: CVE-2022-20616 Source advisory: MEND:CVE-2022-20616...

CVE-2022-20616: Missing Authorization

Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file...

Jenkins plugin: Vulnerabilities related to permissions, licensing, and access control

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.The Jenkins Credentials Binding Plugin is vulnerable to an input validation error that stems from the plugin's failure to...

PT-2022-14825 · Jenkins · Jenkins Credentials Binding Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Credentials Binding Plugin versions 1.27 and earlier Jenkins Credentials Binding Plugin versions prior to 1.27.1 Jenkins Credentials Binding Plugin versions prior to 1.24.1 Description: The issue allows attackers with Overall/Read...

Missing permission check in credentials-binding allows validating secret file credentials IDs

credentials-binding 1.27 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file. credentials-binding 1.27.1 performs...

org.jenkins-ci.plugins:credentials-binding (1.0-beta-1), org.jenkins-ci.plugins:plain-credentials (>=1.0-beta-1, <=1.0) potentially affected by CVE-2021-21648 via org.jenkins-ci.plugins:credentials (1.8.2)

org.jenkins-ci.plugins:credentials MAVEN version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - org.jenkins-ci.plugins:credentials-binding 1.0-beta-1 -...

com.cloudbees.jenkins.plugins:cloudbees-registration (3.15), io.jenkins.blueocean:blueocean-pipeline-editor (>=1.0-alpha-3, <=1.0-alpha-4) +3 more potentially affected by CVE-2021-21648 via org.jenkins-ci.plugins:credentials (1.23)

org.jenkins-ci.plugins:credentials MAVEN version 1.23 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - com.cloudbees.jenkins.plugins:cloudbees-registration 3.15 -...

jenkins-credentials-binding-plugin: information disclosure in build log when build contains no build steps

Jenkins Credentials Binding Plugin 1.22 and earlier does not mask i.e., replace with asterisks secrets in the build log when the build contains no build steps...

jenkins-credentials-binding-plugin: improper masking of secrets

Jenkins Credentials Binding Plugin 1.22 and earlier does not mask i.e., replace with asterisks secrets containing a $ character in some circumstances...

jenkins-credentials-binding-plugin: improper masking of secrets

Jenkins Credentials Binding Plugin 1.22 and earlier does not mask i.e., replace with asterisks secrets containing a $ character in some circumstances...

jenkins-credentials-binding-plugin: information disclosure in build log when build contains no build steps

Jenkins Credentials Binding Plugin 1.22 and earlier does not mask i.e., replace with asterisks secrets in the build log when the build contains no build steps...

jenkins-credentials-binding-plugin: information disclosure in build log when build contains no build steps

Jenkins Credentials Binding Plugin 1.22 and earlier does not mask i.e., replace with asterisks secrets in the build log when the build contains no build steps...

jenkins-credentials-binding-plugin: improper masking of secrets

Jenkins Credentials Binding Plugin 1.22 and earlier does not mask i.e., replace with asterisks secrets containing a $ character in some circumstances...

jenkins-credentials-binding-plugin: improper masking of secrets

Jenkins Credentials Binding Plugin 1.22 and earlier does not mask i.e., replace with asterisks secrets containing a $ character in some circumstances...