CVE-2022-36891

CVE-2022-36891 affects Jenkins Deployer Framework Plugin versions 85.v1d1888e8c021 and earlier. The root cause is a missing permission check in an HTTP endpoint, allowing attackers with Item/Read permission but without Deploy Now/Deploy permission to read deployment logs. The vulnerability contex...

org.jenkins-ci.plugins:cloudbees-deployer-plugin (6.0) potentially affected by CVE-2022-36891 via org.jenkins-ci.plugins:deployer-framework (1.0)

org.jenkins-ci.plugins:deployer-framework MAVEN version 1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:deployer-framework and may be impacted: - org.jenkins-ci.plugins:cloudbees-deployer-plugin 6.0 Source cves: CVE-2022-3689...

CVE-2022-36891

A missing permission check in Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier allows attackers with Item/Read permission but without Deploy Now/Deploy permission to read deployment logs...

CVE-2022-36890

CVE-2022-36890 concerns the Jenkins Deployer Framework Plugin (85.v1d1888e8c021 and earlier). The issue is an unrestricted filename in methods implementing form validation, enabling attackers with Item/Read permission to determine the existence of an attacker-specified path on the Jenkins control...

CVE-2022-36890

Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the name of files in methods implementing form validation, allowing attackers with Item/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system...

org.jenkins-ci.plugins:cloudbees-deployer-plugin (6.0) potentially affected by CVE-2022-36890 via org.jenkins-ci.plugins:deployer-framework (1.0)

org.jenkins-ci.plugins:deployer-framework MAVEN version 1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:deployer-framework and may be impacted: - org.jenkins-ci.plugins:cloudbees-deployer-plugin 6.0 Source cves: CVE-2022-3689...

CVE-2022-36890

Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the name of files in methods implementing form validation, allowing attackers with Item/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system...

CVE-2022-36890

Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the name of files in methods implementing form validation, allowing attackers with Item/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system...

CVE-2022-36889

Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowing attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller file system to the selected service...

CVE-2022-36889

Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowing attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller file system to the selected service...

CVE-2022-36889

CVE-2022-36889 affects Jenkins Deployer Framework Plugin versions 85.v1d1888e8c021 and earlier. The root cause is that the plugin does not restrict the application path when configuring a deployment, enabling attackers with Item/Configure permission to upload arbitrary files from the Jenkins cont...

CVE-2022-36889

Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowing attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller file system to the selected service...

org.jenkins-ci.plugins:cloudbees-deployer-plugin (6.0) potentially affected by CVE-2022-36889 via org.jenkins-ci.plugins:deployer-framework (1.0)

org.jenkins-ci.plugins:deployer-framework MAVEN version 1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:deployer-framework and may be impacted: - org.jenkins-ci.plugins:cloudbees-deployer-plugin 6.0 Source cves: CVE-2022-3688...

CVE-2022-36909: Missing Authorization

A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system and to upload a SSH key file from the Jenkins controller file system ...

CVE-2022-36908: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to check for the existence of an attacker-specified file path on the Jenkins controller file system and to upload a SSH key file from the Jenkins controller file system to an...

CVE-2022-36907: Missing Authorization

A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password...

CVE-2022-36906: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified username and password...

Path traversal vulnerability in deployer-framework allows reading arbitrary files

deployer-framework 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment. This allows attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller file system to the selected service...

Missing permission check in deployer-framework allows reading deployment logs

deployer-framework 85.v1d1888e8c021 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Item/Read permission to read deployment logs. deployer-framework 86.v7ba4a55bf3ec requires Deploy Now/Deploy permission to read deployment logs...

CSRF vulnerability and missing permission check in openshift-deployer

openshift-deployer 1.2.0 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password. Additionally, this form validation method...