PT-2020-15556 · Jenkins · Jenkins Chaos Monkey Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Chaos Monkey Plugin versions 0.3 and earlier Description: The issue concerns the Jenkins Chaos Monkey Plugin, where several HTTP endpoints do not perform permission checks. This allows attackers with Overall/Read permission to generat...

PT-2020-15557 · Jenkins · Jenkins Chaos Monkey Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Chaos Monkey Plugin versions 0.4 and earlier Description: The issue allows attackers with Overall/Read permission to access the Chaos Monkey page and see the history of actions due to a lack of permission checks in an HTTP endpoint...

CVE-2020-2323: Missing Authorization

Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read permission to access the Chaos Monkey page and to see the history of actions...

CVE-2020-2322: Missing Authorization

Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to generate load and to generate memory leaks...

Missing permission checks in chaos-monkey

chaos-monkey 0.4 and earlier does not perform permission checks in an HTTP endpoint. This allows attackers with Overall/Read permission to access the Chaos Monkey page and to see the history of actions. chaos-monkey 0.4.1 requires Overall/Administer permission to access the Chaos Monkey page and ...

Missing permission checks in chaos-monkey

chaos-monkey 0.3 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to generate load and to generate memory leaks. chaos-monkey 0.4 requires Overall/Administer permission to generate load and to generate memory leaks...

jenkins-2-plugins/blueocean: Blue Ocean Plugin does not perform permission checks in several HTTP endpoints implementing connection tests.

A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL...

CVE-2020-2309

A missing/An incorrect permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2020-2302

A missing permission check in Jenkins Active Directory Plugin 2.19 and earlier allows attackers with Overall/Read permission to access the domain health check diagnostic page...

CVE-2020-2306

A missing permission check in Jenkins Mercurial Plugin 2.11 and earlier allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations...

CVE-2020-2309

A missing/An incorrect permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

Information disclosure

A missing permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to list global pod template names...

CVE-2020-2311

A missing permission check in Jenkins AWS Global Configuration Plugin 1.5 and earlier allows attackers with Overall/Read permission to replace the global AWS configuration...

CVE-2020-2310

Missing permission checks in Jenkins Ansible Plugin 1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2020-2308

The CVE-2020-2308 issue is described in the Jenkins Kubernetes Plugin advisory (GHSA-RR6J-37CV-C7X7). It states that, prior to versions 1.27.4, 1.26.5, 1.25.4.1, and 1.21.6, the plugin does not perform a permission check on a Kubernetes HTTP endpoint, allowing attackers with Overall/Read permissi...

CVE-2020-2306

A missing permission check in Jenkins Mercurial Plugin 2.11 and earlier allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations...

PT-2020-15538 · Jenkins · Jenkins Kubernetes Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Kubernetes Plugin versions 1.27.3 and earlier Jenkins Kubernetes Plugin versions prior to 1.27.4 Jenkins Kubernetes Plugin versions prior to 1.26.5 Jenkins Kubernetes Plugin versions prior to 1.25.4.1 Jenkins Kubernetes Plugin version...

CVE-2020-2302: Missing Authorization

A missing permission check in Jenkins Active Directory Plugin 2.19 and earlier allows attackers with Overall/Read permission to access the domain health check diagnostic page...

CVE-2020-2309: Undefined Security Weakness

A missing/An incorrect permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2020-2311: Undefined Security Weakness

A missing permission check in Jenkins AWS Global Configuration Plugin 1.5 and earlier allows attackers with Overall/Read permission to replace the global AWS configuration...