CVE-2022-28146

Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Item/Configure permission to read arbitrary files on the Jenkins controller by specifying an input folder on the Jenkins controller as a parameter to its build steps...

CVE-2022-28146

The CVE-2022-28146 issue affects Jenkins Continuous Integration with Toad Edge Plugin, version 2.3 and earlier. Vulnerability: the plugin allows attackers with Item/Configure permission to read arbitrary files on the Jenkins controller by passing an input folder as a parameter to build steps. Thi...

CVE-2022-28145

CVE-2022-28145 concerns Jenkins with the Toad Edge Plugin (version 2.3 and earlier). The published descriptions state that this plugin does not apply Content-Security-Policy headers to report files it serves, enabling a stored XSS vulnerability. This can be exploited by attackers who have Item/Co...

CVE-2022-28145

Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier does not apply Content-Security-Policy headers to report files it serves, resulting in a stored cross-site scripting XSS exploitable by attackers with Item/Configure permission or otherwise able to control report contents...

CVE-2022-28145

Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier does not apply Content-Security-Policy headers to report files it serves, resulting in a stored cross-site scripting XSS exploitable by attackers with Item/Configure permission or otherwise able to control report contents...

CVE-2022-28148: Improper Limitation of a Pathname to a Restricted Directory

The file browser in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier may interpret some paths to files as absolute on Windows, resulting in a path traversal vulnerability allowing attackers with Item/Read permission to obtain the contents of arbitrary files on Windows...

CVE-2022-28145: Improper Neutralization of Input During Web Page Generation

Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier does not apply Content-Security-Policy headers to report files it serves, resulting in a stored cross-site scripting XSS exploitable by attackers with Item/Configure permission or otherwise able to control report contents...

PT-2022-18844 · Jenkins +1 · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins Continuous Integration with Toad Edge Plugin versions 2.3 and earlier Description: The issue is related to the lack of Content-Security-Policy headers in report files served by the software, resulting in a stored cross-site scripting...

Jenkins Continuous Integration with Toad Edge Plugin: Cross-site Scripting Vulnerabilities

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.Jenkins Continuous Integration with Toad...

Missing permission check in ci-with-toad-edge

ci-with-toad-edge 2.3 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. ci-with-toad-edge 2.4 requires...

Path traversal vulnerability on Windows in ci-with-toad-edge

ci-with-toad-edge 2.3 and earlier uses a patched fork of an old version of the file browser for workspaces, archived artifacts, and userContent/ from Jenkins core DirectoryBrowserSupport to serve reports. The fork did not receive the fix for SECURITY-2481 in Jenkins 2.315 and LTS 2.303.2. This...

XSS vulnerability in ci-with-toad-edge

ci-with-toad-edge 2.3 and earlier uses a patched fork of an old version of the file browser for workspaces, archived artifacts, and userContent/ from Jenkins core DirectoryBrowserSupport to serve reports. This fork removes the Content-Security-Policy header functionality introduced for SECURITY-9...

Arbitrary file read vulnerability in ci-with-toad-edge

ci-with-toad-edge 2.3 and earlier allows attackers with Item/Configure permission to read arbitrary files on the Jenkins controller by specifying an input folder on the Jenkins controller as a parameter to its build steps. ci-with-toad-edge 2.4 only allows copying files from the node the build is...

PT-2022-18847 · Jenkins +1 · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins Continuous Integration with Toad Edge Plugin versions 2.3 and earlier Description: The file browser in Jenkins Continuous Integration with Toad Edge Plugin may interpret some paths to files as absolute on Windows, resulting in a path...

Jenkins Continuous Integration with Toad Edge Plugin: Path traversal vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. An attacker with Item/Configure privileges can read arbitrary files on the...

CVE-2022-28147: Missing Authorization

A missing permission check in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system...

CVE-2022-28146: Improper Limitation of a Pathname to a Restricted Directory

Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Item/Configure permission to read arbitrary files on the Jenkins controller by specifying an input folder on the Jenkins controller as a parameter to its build steps...

PT-2022-18845 · Jenkins +1 · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins Continuous Integration with Toad Edge Plugin versions 2.3 and earlier Description: The issue allows attackers with Item/Configure permission to read arbitrary files on the Jenkins controller by specifying an input folder on the Jenkin...

Jenkins Continuous Integration with Toad Edge Plugin: Access Control Error Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.An access control error vulnerability exis...

Jenkins Continuous Integration with Toad Edge Plugin: Path traversal vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.A path traversal vulnerability exists in...