CVE-2022-30955

CVE-2022-30955 affects Jenkins GitLab Plugin (≤ 1.5.31). The issue is a missing permission check on an HTTP endpoint that allows users with Overall/Read to enumerate credentials IDs stored in Jenkins, exposing credential identifiers. The primary sources (NVD entry and related advisories) describe...

org.jenkins-ci.plugins:gitlab-plugin (>=1.1.6, <=1.1.28), org.jenkins-ci.plugins:salesforce-migration-assistant-plugin (>=2.2.0, <=2.2.2) +1 more potentially affected by CVE-2017-1000092 via org.jenkins-ci.plugins:git (2.3.1)

org.jenkins-ci.plugins:git MAVEN version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:gitlab-plugin =1.1.6, =2.2.0, =1.3.0, =1.3.1 Source cves: CVE-2017-1000092 Source...

Jenkins GitLab Plugin 权限许可和访问控制问题漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.The Jenkins GitLab Plugin 1.5.31 and earli...

PT-2022-20410 · Jenkins · Jenkins Git Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins GitLab Plugin versions 1.5.31 and earlier Description: The issue allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins due to a missing permission check in an HTTP endpoint...

CVE-2022-30955: Missing Authorization

Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

Missing permission check in gitlab-plugin allows enumerating credentials IDs

gitlab-plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability...

org.jenkins-ci.plugins:bitbucket-pullrequest-builder (>=1.4.29, <=1.5.0), org.jenkins-ci.plugins:coding-webhook (>=1.0.0, <=1.4.3) +3 more potentially affected by CVE-2018-1000182 via org.jenkins-ci.plugins:git (2.4.1)

org.jenkins-ci.plugins:git MAVEN version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:bitbucket-pullrequest-builder =1.4.29, =1.0.0, =1.0.11, =1.1.29, =2.4.0, =2.4.1 Sour...

Unspecified Vulnerability in CloudBees Jenkins Violation Comments to GitLab Plugin

CloudBees Jenkins Hudson Labs is a set of Java-based continuous integration tools from CloudBees. The product is mainly used to monitor the continuous software version of the release/testing project and some timed tasks . Violation Comments to GitLab Plugin is used in one of the ability to merge...

Unspecified Vulnerability in CloudBees Jenkins Violation Comments to GitLab Plugin

CloudBees Jenkins Hudson Labs is a set of Java-based continuous integration tools from CloudBees. The product is mainly used to monitor the continuous software version of the release/testing project and some timed tasks . Violation Comments to GitLab Plugin is used in one of the ability to merge...

CVE-2019-10429

Jenkins GitLab Logo Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

CVE-2019-10416

Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10415

Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

CVE-2019-10415

Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

Design/Logic Flaw

Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

CVE-2019-10415

Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

CVE-2019-10415

Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

CVE-2019-10416

Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10415

CVE-2019-10415 affects Jenkins Violation Comments to GitLab Plugin, version 2.28 and earlier. The root issue is that API tokens/credentials were stored unencrypted in the plugin’s global configuration file on the Jenkins master, enabling viewing by users with access to the master filesystem. Impa...

CVE-2019-10416

Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10416

Summary: CVE-2019-10416 affects the Jenkins Violation Comments to GitLab Plugin (version 2.28 and earlier). The underlying issue is storage of credentials in plaintext within job config.xml files on the Jenkins master, exposing tokens to users with Extended Read permission or anyone with access t...