EUVD-2022-4246

Malicious code in bioql PyPI...

jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin

A cross-site request forgery CSRF vulnerability was found in a Jenkins plugin. This issue may allow an unauthenticated attacker to access Jenkins builds, bypassing CSRF protections. This could compromise the integrity, availability, and confidentiality of Jenkins...

jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin

A cross-site request forgery CSRF vulnerability was found in a Jenkins plugin. This issue may allow an unauthenticated attacker to access Jenkins builds, bypassing CSRF protections. This could compromise the integrity, availability, and confidentiality of Jenkins...

SUSE CVE-2017-1000108

The Pipeline: Input Step Plugin by default allowed users with Item/Read access to a pipeline to interact with the step to provide input. This has been changed, and now requires users to have the Item/Build permission instead...

jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin

A cross-site request forgery CSRF vulnerability was found in a Jenkins plugin. This issue may allow an unauthenticated attacker to access Jenkins builds, bypassing CSRF protections. This could compromise the integrity, availability, and confidentiality of Jenkins...

jenkins-plugin: Arbitrary file write vulnerability in Pipeline Input Step Plugin

A flaw was found in the Pipeline Input Step Plugin. This issue affects the code of the component Archive File Handler. The manipulation of the argument file with a malicious input leads to a directory traversal vulnerability...

jenkins-plugin: Arbitrary file write vulnerability in Pipeline Input Step Plugin

A flaw was found in the Pipeline Input Step Plugin. This issue affects the code of the component Archive File Handler. The manipulation of the argument file with a malicious input leads to a directory traversal vulnerability...

net.praqma:memory-map (>=2.2.0, <=2.2.1), org.jenkins-ci.plugins.workflow:workflow-aggregator (>=2.3, <=2.4) +2 more potentially affected by CVE-2022-43407 via org.jenkins-ci.plugins:pipeline-input-step (2.1)

org.jenkins-ci.plugins:pipeline-input-step MAVEN version 2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:pipeline-input-step and may be impacted: - net.praqma:memory-map =2.2.0, =2.3, =2.0.5, =1.0.0, =1.0.1 Source cves:...

io.jenkins.blueocean:blueocean (>=1.1.0-beta-4, <=1.2.0-beta-1), io.jenkins.blueocean:blueocean-events (>=1.1.0-beta-4, <=1.2.0-beta-1) +3 more potentially affected by CVE-2022-43407 via org.jenkins-ci.plugins:pipeline-input-step (2.7)

org.jenkins-ci.plugins:pipeline-input-step MAVEN version 2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:pipeline-input-step and may be impacted: - io.jenkins.blueocean:blueocean =1.1.0-beta-4, =1.1.0-beta-4, =1.1.0-beta-4,...

io.jenkins.blueocean:blueocean (>=1.1.6, <=1.1.7), io.jenkins.blueocean:blueocean-events (>=1.1.6, <=1.1.7) +6 more potentially affected by CVE-2022-43407 via org.jenkins-ci.plugins:pipeline-input-step (2.8)

org.jenkins-ci.plugins:pipeline-input-step MAVEN version 2.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:pipeline-input-step and may be impacted: - io.jenkins.blueocean:blueocean =1.1.6, =1.1.6, =1.1.6, =1.1.6, =2.0.0, =1.7,...

com.testinium.jenkins:testinium (1.0), io.jenkins.blueocean:blueocean (>=1.0.0-b24, <=1.1.0-beta-2) +16 more potentially affected by CVE-2022-43407 via org.jenkins-ci.plugins:pipeline-input-step (2.5)

org.jenkins-ci.plugins:pipeline-input-step MAVEN version 2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:pipeline-input-step and may be impacted: - com.testinium.jenkins:testinium 1.0 - io.jenkins.blueocean:blueocean...

org.jenkins-ci.plugins:templating-engine (>=2.3, <=2.5.3) potentially affected by CVE-2022-43407 via org.jenkins-ci.plugins:pipeline-input-step (2.12)

org.jenkins-ci.plugins:pipeline-input-step MAVEN version 2.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:pipeline-input-step and may be impacted: - org.jenkins-ci.plugins:templating-engine =2.3, =2.5.3 Source cves:...

com.splunk.splunkins:splunk-devops-extend (>=1.0, <=1.7.0), io.fabric8.jenkins.plugins:openshift-sync (>=y, <=1.0.45) +14 more potentially affected by CVE-2022-43407 via org.jenkins-ci.plugins:pipeline-input-step (2.0)

org.jenkins-ci.plugins:pipeline-input-step MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:pipeline-input-step and may be impacted: - com.splunk.splunkins:splunk-devops-extend =1.0, =y, =1.0.0-b10, =1.0.0-b10,...

Cross site request forgery (csrf)

Jenkins Pipeline: Input Step Plugin 451.vf1aa4f405289 and earlier does not restrict or sanitize the optionally specified ID of the 'input' step, which is used for the URLs that process user interactions for the given 'input' step proceed or abort and is not correctly encoded, allowing attackers...

CVE-2022-43407: Cross-Site Request Forgery (CSRF)

Jenkins Pipeline: Input Step Plugin 451.vf1aa4f405289 and earlier does not restrict or sanitize the optionally specified ID of the 'input' step, which is used for the URLs that process user interactions for the given 'input' step proceed or abort and is not correctly encoded, allowing attackers...

Jenkins Plugin Pipeline:Input Step 跨站请求伪造漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

CVE-2022-43407

Jenkins Pipeline: Input Step Plugin 451.vf1aa4f405289 and earlier does not restrict or sanitize the optionally specified ID of the 'input' step, which is used for the URLs that process user interactions for the given 'input' step proceed or abort and is not correctly encoded, allowing attackers...

com.splunk.splunkins:splunk-devops-extend (>=1.0, <=1.7.0), com.testinium.jenkins:testinium (1.0) +27 more potentially affected by CVE-2022-43407 via org.jenkins-ci.plugins:pipeline-input-step (>=2.0, <=2.12)

org.jenkins-ci.plugins:pipeline-input-step MAVEN version =2.0, =1.0, =y, =1.0.0-b10, =1.0.0-b10, =1.0.0-b10, =1.0.0-b15, =1.0.0-b15, =1.0.0-b10, =1.0.0-b10, =0.1-preview-4, =2.2.0, =1.8-beta-1, =1.8-beta-1, =2.0, =2.5 and more Source cves: CVE-2022-43407 Source advisory: MEND:CVE-2022-43407...

CSRF protection for any URL can be bypassed in pipeline-input-step

pipeline-input-step 451.vf1aa4f405289 and earlier does not restrict or sanitize the optionally specified ID of the input step. This ID is used for the URLs that process user interactions for the given input step proceed or abort and is not correctly encoded. This allows attackers able to configur...

jenkins-plugin: Arbitrary file write vulnerability in Pipeline Input Step Plugin

A flaw was found in the Pipeline Input Step Plugin. This issue affects the code of the component Archive File Handler. The manipulation of the argument file with a malicious input leads to a directory traversal vulnerability...