CVE-2020-2294

Jenkins Maven Cascade Release Plugin 1.3.2 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to start cascade builds and layout builds, and reconfigure the plugin...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in Jenkins Maven Cascade Release Plugin 1.3.2 and earlier allows attackers to start cascade builds and layout builds, and reconfigure the plugin...

Design/Logic Flaw

Jenkins Maven Cascade Release Plugin 1.3.2 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to start cascade builds and layout builds, and reconfigure the plugin...

Cross site scripting

Jenkins Release Plugin 2.10.2 and earlier does not escape the release version in badge tooltip, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Release/Release permission...

CVE-2020-2294

CVE-2020-2294 affects Jenkins Maven Cascade Release Plugin (versions 1.3.2 and earlier). The root cause is missing permission checks on several HTTP endpoints, enabling users with Overall/Read to start cascade builds, layout builds, and reconfigure the plugin. Reported impact per sources includes...

CVE-2020-2295

A cross-site request forgery CSRF vulnerability in Jenkins Maven Cascade Release Plugin 1.3.2 and earlier allows attackers to start cascade builds and layout builds, and reconfigure the plugin...

CVE-2020-2295

A CSRF vulnerability affects Jenkins Maven Cascade Release Plugin 1.3.2 and earlier, allowing an attacker to start cascade/layout builds and reconfigure the plugin. Root cause: missing CSRF protection in the plugin’s request handling. Impact: unauthorized build actions and plugin reconfiguration....

CVE-2020-2294

Jenkins Maven Cascade Release Plugin 1.3.2 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to start cascade builds and layout builds, and reconfigure the plugin...

CVE-2020-2292

Jenkins Release Plugin 2.10.2 and earlier does not escape the release version in badge tooltip, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Release/Release permission...

CVE-2020-2292

CVE-2020-2292 affects Jenkins Release Plugin versions 2.10.2 and earlier. The root cause is failure to escape the release version in the badge tooltip, causing a stored XSS vulnerability exploitable by attackers with Release/Release permission. Mitigation: upgrade to a version later than 2.10.2 (...

PT-2020-15522 · Jenkins · Jenkins Release Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Release Plugin versions 2.10.2 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability. This occurs because the release version in the badge tooltip is not properly escaped. Attackers with...

PT-2020-15525 · Jenkins · Jenkins Maven Cascade Release Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Maven Cascade Release Plugin versions 1.3.2 and earlier Description: A cross-site request forgery issue allows attackers to start cascade builds and layout builds, and reconfigure the plugin. Recommendations: For Jenkins Maven Cascade...

Jenkins ClearCase Release Plugin XSS Injection Vulnerability

Jenkins is an open source software project , is based on Java development of a continuous integration tool for monitoring continuous repetitive work , aims to provide an open and easy to use software platform . Jenkins ClearCase Release Plugin product has an XSS injection vulnerability , the...

CVE-2020-2270

Jenkins ClearCase Release Plugin 0.3 and earlier does not escape the composite baseline in badge tooltip, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission...

CVE-2020-2270

Jenkins ClearCase Release Plugin 0.3 and earlier does not escape the composite baseline in badge tooltip, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission...

Cross site scripting

Jenkins ClearCase Release Plugin 0.3 and earlier does not escape the composite baseline in badge tooltip, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission...

CVE-2020-2270

CVE-2020-2270 affects the Jenkins ClearCase Release Plugin (versions 0.3 and earlier). The root cause is that the composite baseline in the badge tooltip is not escaped, causing a stored XSS vulnerability. Exploitation is feasible by attackers with Job/Configure permission. Remediation: upgrade t...

PT-2020-15495 · Jenkins · Jenkins Clearcase Release Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins ClearCase Release Plugin version 0.3 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because the composite baseline in the badge tooltip is not properly escaped, allowing...

Design/Logic Flaw

Jenkins BMC Release Package and Deployment Plugin 1.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

CloudBees Jenkins Maven Release Plugin Code Issue Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Maven Release Plugin is used in one of the...