Design/Logic Flaw

A missing permission check in Jenkins Mac Plugin 1.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials...

CVE-2020-2148

A missing permission check in Jenkins Mac Plugin 1.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials...

CVE-2020-2148

CVE-2020-2148 affects Jenkins Mac Plugin (versions 1.1.0 and earlier). The root cause is a missing permission check that allows attackers with Overall/Read to connect to an attacker-specified SSH server using attacker-specified credentials. The connected documents confirm the vulnerability detail...

CVE-2020-2147

CVE-2020-2147 affects the Jenkins Mac Plugin, specifically versions 1.1.0 and earlier. The issue is a cross-site request forgery (CSRF) that allows an attacker to cause the plugin to connect to an attacker-specified SSH server using attacker-specified credentials. The published metrics list a CVS...

CVE-2020-2146

Summary (CVE-2020-2146) : Jenkins Mac Plugin, versions 1.1.0 and earlier, does not validate SSH host keys when connecting agents, enabling man-in-the-middle attacks. This behavior is confirmed across multiple sources in the provided documents. Impact : lack of host-key validation could allow inte...

CVE-2020-2147

A cross-site request forgery vulnerability in Jenkins Mac Plugin 1.1.0 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials...

CVE-2020-2146

Jenkins Mac Plugin 1.1.0 and earlier does not validate SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks...

PT-2020-15359 · Jenkins · Jenkins Mabl Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Mac Plugin versions 1.1.0 and earlier Description: A missing permission check in the Jenkins Mac Plugin allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials...

PT-2020-15358 · Jenkins · Jenkins Mabl Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Mac Plugin versions 1.1.0 and earlier Description: A cross-site request forgery issue allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials. Recommendations: For Jenkins Mac Plugin versio...

CVE-2020-2147: Cross-Site Request Forgery (CSRF)

A cross-site request forgery vulnerability in Jenkins Mac Plugin 1.1.0 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials...

CVE-2020-2148: Incorrect Authorization

A missing permission check in Jenkins Mac Plugin 1.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials...

PT-2020-15357 · Jenkins · Jenkins Mabl Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Mac Plugin versions 1.1.0 and earlier Description: The issue concerns the lack of SSH host key validation when connecting agents created by the plugin, which could enable man-in-the-middle attacks. This allows an attacker to intercept...

CVE-2020-2146: Improper Verification of Cryptographic Signature

Jenkins Mac Plugin 1.1.0 and earlier does not validate SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks...