org.jenkins-ci.lib:xtrigger-lib (>=0.34, <=0.36), org.jenkins-ci.main:jenkins-test-harness (>=1.535, <=1.644) +3 more potentially affected by CVE-2021-21623 via org.jenkins-ci.plugins:matrix-auth (1.0.2)

org.jenkins-ci.plugins:matrix-auth MAVEN version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:matrix-auth and may be impacted: - org.jenkins-ci.lib:xtrigger-lib =0.34, =1.535, =1.645, =1.0, =1.4 -...

org.jenkins-ci.plugins:role-strategy (>=2.4.0, <=2.6.0), org.jenkins-ci.plugins:view-job-filters (>=2.0.0, <=2.0.2) potentially affected by CVE-2021-21623 via org.jenkins-ci.plugins:matrix-auth (1.0)

org.jenkins-ci.plugins:matrix-auth MAVEN version 1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:matrix-auth and may be impacted: - org.jenkins-ci.plugins:role-strategy =2.4.0, =2.0.0, =2.0.2 Source cves: CVE-2021-21623 Sourc...

com.joelj.jenkins:ez-templates (1.0.5), com.synopsys.jenkinsci:ownership (>=0.9.0-beta-1, <=0.10.0) +2 more potentially affected by CVE-2021-21623 via org.jenkins-ci.plugins:matrix-auth (1.2)

org.jenkins-ci.plugins:matrix-auth MAVEN version 1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:matrix-auth and may be impacted: - com.joelj.jenkins:ez-templates 1.0.5 - com.synopsys.jenkinsci:ownership =0.9.0-beta-1, =1.0,...

org.jenkins-ci.plugins:seed (>=1.0-beta.2, <=2.1.4) potentially affected by CVE-2021-21623 via org.jenkins-ci.plugins:matrix-auth (1.4)

org.jenkins-ci.plugins:matrix-auth MAVEN version 1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:matrix-auth and may be impacted: - org.jenkins-ci.plugins:seed =1.0-beta.2, =2.1.4 Source cves: CVE-2021-21623 Source advisory:...

com.synopsys.jenkinsci:ownership (>=0.11.0, <=0.13.0), org.jenkins-ci.plugins:azure-ad (>=0.1.1, <=0.2.0) +1 more potentially affected by CVE-2021-21623 via org.jenkins-ci.plugins:matrix-auth (1.7)

org.jenkins-ci.plugins:matrix-auth MAVEN version 1.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:matrix-auth and may be impacted: - com.synopsys.jenkinsci:ownership =0.11.0, =0.1.1, =2.6.1, =2.9.0 Source cves: CVE-2021-21623...

org.jenkins-ci.plugins:role-strategy (>=2.4.0, <=2.6.0), org.jenkins-ci.plugins:view-job-filters (>=2.0.0, <=2.0.2) potentially affected by CVE-2020-2226 via org.jenkins-ci.plugins:matrix-auth (1.0)

org.jenkins-ci.plugins:matrix-auth MAVEN version 1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:matrix-auth and may be impacted: - org.jenkins-ci.plugins:role-strategy =2.4.0, =2.0.0, =2.0.2 Source cves: CVE-2020-2226 Source...

org.jenkins-ci.lib:xtrigger-lib (>=0.34, <=0.36), org.jenkins-ci.main:jenkins-test-harness (>=1.535, <=1.644) +3 more potentially affected by CVE-2020-2226 via org.jenkins-ci.plugins:matrix-auth (1.0.2)

org.jenkins-ci.plugins:matrix-auth MAVEN version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:matrix-auth and may be impacted: - org.jenkins-ci.lib:xtrigger-lib =0.34, =1.535, =1.645, =1.0, =1.4 -...

org.openshift.jenkins:openshift-login (>=0.1, <=1.0.21) potentially affected by CVE-2020-2226 via org.jenkins-ci.plugins:matrix-auth (1.1)

org.jenkins-ci.plugins:matrix-auth MAVEN version 1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:matrix-auth and may be impacted: - org.openshift.jenkins:openshift-login =0.1, =1.0.21 Source cves: CVE-2020-2226 Source advisor...

com.joelj.jenkins:ez-templates (1.0.5), com.synopsys.jenkinsci:ownership (>=0.9.0-beta-1, <=0.10.0) +2 more potentially affected by CVE-2020-2226 via org.jenkins-ci.plugins:matrix-auth (1.2)

org.jenkins-ci.plugins:matrix-auth MAVEN version 1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:matrix-auth and may be impacted: - com.joelj.jenkins:ez-templates 1.0.5 - com.synopsys.jenkinsci:ownership =0.9.0-beta-1, =1.0,...

org.jenkins-ci.plugins:seed (>=1.0-beta.2, <=2.1.4) potentially affected by CVE-2020-2226 via org.jenkins-ci.plugins:matrix-auth (1.4)

org.jenkins-ci.plugins:matrix-auth MAVEN version 1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:matrix-auth and may be impacted: - org.jenkins-ci.plugins:seed =1.0-beta.2, =2.1.4 Source cves: CVE-2020-2226 Source advisory:...

com.synopsys.jenkinsci:ownership (>=0.11.0, <=0.13.0), org.jenkins-ci.plugins:azure-ad (>=0.1.1, <=0.2.0) +1 more potentially affected by CVE-2020-2226 via org.jenkins-ci.plugins:matrix-auth (1.7)

org.jenkins-ci.plugins:matrix-auth MAVEN version 1.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:matrix-auth and may be impacted: - com.synopsys.jenkinsci:ownership =0.11.0, =0.1.1, =2.6.1, =2.9.0 Source cves: CVE-2020-2226...

com.loadimpact:loadimpact-plugin (>=1.53, <=1.58), org.jenkins-ci.main:jenkins-test-harness (1.535) +5 more potentially affected by CVE-2020-2221 via org.jenkins-ci.main:jenkins-core (1.535)

org.jenkins-ci.main:jenkins-core MAVEN version 1.535 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.loadimpact:loadimpact-plugin =1.53, =1.18, =1.1, =1.2 - org.jenkins-ci.plugins:plugin 1.535...

com.loadimpact:loadimpact-plugin (>=1.53, <=1.58), org.jenkins-ci.main:jenkins-test-harness (1.535) +5 more potentially affected by CVE-2020-2101 via org.jenkins-ci.main:jenkins-core (1.535)

org.jenkins-ci.main:jenkins-core MAVEN version 1.535 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.loadimpact:loadimpact-plugin =1.53, =1.18, =1.1, =1.2 - org.jenkins-ci.plugins:plugin 1.535...

com.loadimpact:loadimpact-plugin (>=1.53, <=1.58), org.jenkins-ci.main:jenkins-test-harness (1.535) +5 more potentially affected by CVE-2020-2100 via org.jenkins-ci.main:jenkins-core (1.535)

org.jenkins-ci.main:jenkins-core MAVEN version 1.535 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.loadimpact:loadimpact-plugin =1.53, =1.18, =1.1, =1.2 - org.jenkins-ci.plugins:plugin 1.535...

com.loadimpact:loadimpact-plugin (>=1.53, <=1.58), org.jenkins-ci.main:jenkins-test-harness (1.535) +5 more potentially affected by CVE-2019-10354 via org.jenkins-ci.main:jenkins-core (1.535)

org.jenkins-ci.main:jenkins-core MAVEN version 1.535 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.loadimpact:loadimpact-plugin =1.53, =1.18, =1.1, =1.2 - org.jenkins-ci.plugins:plugin 1.535...

com.loadimpact:loadimpact-plugin (>=1.53, <=1.58), org.jenkins-ci.main:jenkins-test-harness (1.535) +5 more potentially affected by CVE-2018-1000406 via org.jenkins-ci.main:jenkins-core (1.535)

org.jenkins-ci.main:jenkins-core MAVEN version 1.535 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.loadimpact:loadimpact-plugin =1.53, =1.18, =1.1, =1.2 - org.jenkins-ci.plugins:plugin 1.535...

com.loadimpact:loadimpact-plugin (>=1.53, <=1.58), org.jenkins-ci.main:jenkins-test-harness (1.535) +5 more potentially affected by CVE-2018-1000861 via org.jenkins-ci.main:jenkins-core (1.535)

org.jenkins-ci.main:jenkins-core MAVEN version 1.535 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.loadimpact:loadimpact-plugin =1.53, =1.18, =1.1, =1.2 - org.jenkins-ci.plugins:plugin 1.535...

Incorrect permission checks in matrix-auth may allow accessing some items

Items like jobs can be organized hierarchically in Jenkins, using the Folders Plugin or something similar. An item is expected to be accessible only if all its ancestors are accessible as well. matrix-auth 2.6.5 and earlier does not correctly perform permission checks to determine whether an item...

Stored XSS vulnerability in matrix-auth

matrix-auth 2.6.1 and earlier does not escape user names shown in the permission table. This results in a stored cross-site scripting XSS vulnerability. When using project-based matrix authorization, this vulnerability can be exploited by a user with Job/Configure or Agent/Configure permission,...