Missing Authorization

Overview org.jenkins-ci.plugins:global-build-stats is a global-build-stats plugin Affected versions of this package are vulnerable to Missing Authorization via the REST API endpoints, which do not perform permission checks. An attacker can enumerate graph IDs by sending requests with only...

CVE-2025-58459

The Jenkins global-build-stats Plugin (version 322.v22f4db_18e2dd and earlier) is vulnerable to an authorization bypass because it fails to perform necessary permission checks on its REST API endpoints . This flaw allows attackers with Overall/Read permissions to enumerate graph IDs and access in...

CVE-2025-58459

Jenkins global-build-stats Plugin 322.v22f4db18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs...

PT-2025-36621

Jenkins global-build-stats Plugin 322.v22f4db 18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs. This has been patched in version 347.v32a eb 0493c4f...

CVE-2025-58459: Improper Access Control

Jenkins global-build-stats Plugin 322.v22f4db18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs...

CVE-2022-27207

Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Overall/Administer permission...

CVE-2022-27207: Improper Neutralization of Input During Web Page Generation

Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Overall/Administer permission...

Cross site request forgery (csrf)

Some URLs provided by Jenkins global-build-stats plugin version 1.4 and earlier returned a JSON response that contained request parameters. These responses had the Content Type: text/html, so could have been interpreted as HTML by clients, resulting in a potential reflected cross-site scripting...

PT-2018-5171

Name of the Vulnerable Software and Affected Versions Jenkins global-build-stats plugin version 1.4 and earlier Description The issue concerns reflected cross-site scripting and cross-site request forgery vulnerabilities. Some URLs provided by the plugin returned JSON responses containing request...