GHSA-C8MF-MC3F-2WVC Plaintext Storage of a Password in Jenkins Convertigo Mobile Platform Plugin

Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

CVE-2022-34199

Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

CVE-2022-34201

A missing permission check in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL...

Information disclosure

A missing permission check in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL...

CVE-2022-34201

The connected documents confirm CVE-2022-34201 affects Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier, caused by a missing permission check in a form-validation method, enabling attackers with Overall/Read to connect to an attacker-specified URL (CSRF risk noted). As of publication, th...

CVE-2022-34200

The CVE-2022-34200 issue affects Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier. It is a CSRF vulnerability in a form-validation method that allows an attacker with Overall/Read permission to connect to an attacker-specified URL, and the vulnerability can be triggered without POST cons...

CVE-2022-34200

A cross-site request forgery CSRF vulnerability in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers to connect to an attacker-specified URL...

CVE-2022-34199

CVE-2022-34199 concerns the Jenkins Convertigo Mobile Platform Plugin (version 1.1 and earlier). The vulnerability arises because passwords are stored unencrypted in the plugin’s configuration files (job config.xml) on the Jenkins controller, making them viewable by users with Extended Read permi...

CVE-2022-34199: Insufficiently Protected Credentials

Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

CVE-2022-34201: Missing Authorization

A missing permission check in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL...

CVE-2022-34200: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers to connect to an attacker-specified URL...

PT-2022-22070 · Jenkins · Jenkins Convertigo Mobile Platform Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Convertigo Mobile Platform Plugin versions 1.1 and earlier Description: A cross-site request forgery issue allows attackers to connect to an attacker-specified URL. Recommendations: For Jenkins Convertigo Mobile Platform Plugin versio...

CVE-2022-25210

Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier uses static fields to store job configuration information, allowing attackers with Item/Configure permission to capture passwords of the jobs that will be configured...

CVE-2022-25210

CVE-2022-25210 affects the Jenkins Convertigo Mobile Platform Plugin up to version 1.1. The vulnerability arises from using static fields to store job configuration information, enabling attackers with Item/Configure permission to capture passwords for jobs that will be configured. This is descri...

CVE-2022-25210: Improper Synchronization

Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier uses static fields to store job configuration information, allowing attackers with Item/Configure permission to capture passwords of the jobs that will be configured...