CVE-2020-2310: Undefined Security Weakness

Missing permission checks in Jenkins Ansible Plugin 1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2020-2308: Undefined Security Weakness

A missing permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to list global pod template names...

CVE-2020-2313: Undefined Security Weakness

A missing permission check in Jenkins Azure Key Vault Plugin 2.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

Missing permission checks in azure-keyvault allow enumerating credentials IDs

azure-keyvault 2.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...

Missing permission check in mercurial

mercurial 2.11 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations. mercurial 2.12 performs permission checks when listing configured Mercurial installations...

Missing permission check in kubernetes allows listing pod templates

kubernetes 1.27.3 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to list global pod template names. kubernetes 1.27.4 requires Overall/Administer permission to list global pod template names...

Missing permission checks in ansible allow enumerating credentials IDs

ansible 1.0 and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...

jenkins-2-plugins/blueocean: Blue Ocean Plugin does not perform permission checks in several HTTP endpoints implementing connection tests.

A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL...

CVE-2020-2294

Jenkins Maven Cascade Release Plugin 1.3.2 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to start cascade builds and layout builds, and reconfigure the plugin...

PT-2020-15523 · Jenkins · Jenkins Persona Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Persona Plugin versions 2.4 and earlier Description: The issue allows users with Overall/Read permission to read arbitrary files on the Jenkins controller. Recommendations: For Jenkins Persona Plugin versions 2.4 and earlier, update t...

CVE-2020-2293: Undefined Security Weakness

Jenkins Persona Plugin 2.4 and earlier allows users with Overall/Read permission to read arbitrary files on the Jenkins controller...

CSRF vulnerability and missing permission checks in maven-release-cascade

maven-release-cascade 1.3.2 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to start cascade builds and layout builds, and reconfigure the plugin. Additionally, these endpoints do not require POST requests, resulting in ...

A server-side request forgery vulnerability exists in Jenkins Git Plugin 3.9.0 and older in AssemblaWeb.java, GitBlitRepositoryBrowser.java, Gitiles.java, TFS2013GitRepositoryBrowser.java, ViewGitWeb.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.

...

CVE-2020-2282

Jenkins Implied Labels Plugin 0.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to configure the plugin...

jenkins: stored XSS vulnerability in project naming strategy

A flaw was found in Jenkins in versions prior to 2.251 and LTS 2.235.3. The project naming strategy description, displayed on item creation, is not properly escaped. This can result in a stored cross-site scripting XSS vulnerability exploitable by users with Overall/Manage permissions. The highes...

PT-2020-15511 · Jenkins · Jenkins Implied Labels Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Implied Labels Plugin versions 0.6 and earlier Description: The issue arises from a lack of permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to configure the plugin. This is resolved in version 0.7...

PT-2020-15515 · Jenkins · Jenkins Liquibase Runner Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Liquibase Runner Plugin versions 1.4.7 and earlier Description: A missing permission check in the plugin allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. This can be done...

CVE-2020-2282: Missing Authorization

Jenkins Implied Labels Plugin 0.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to configure the plugin...

Missing permission check in implied-labels allows reconfiguring the plugin

implied-labels 0.6 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to configure the plugin. implied-labels 0.7 requires Overall/Administer permission to configure the plugin...

Missing permission check in liquibase-runner allows enumerating credentials IDs

liquibase-runner 1.4.7 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...