Chef Sinatra Security Vulnerabilities and Issues — Chef Sinatra CVE List

Lucene search

JenkinsChef Sinatra

5 matches found

CVE•added 2022/02/15 5:15 p.m.•147 views

CVE-2022-25207

A cross-site request forgery (CSRF) vulnerability in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML response.

8.8CVSS8.6AI score0.00072EPSS

CVE•added 2022/02/15 5:15 p.m.•126 views

CVE-2022-25208

A missing permission check in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers with Overall/Read permission to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML response.

8.8CVSS8.4AI score0.00959EPSS

CVE•added 2022/02/15 5:15 p.m.•111 views

CVE-2022-25209

Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

8.8CVSS8.6AI score0.0163EPSS

CVE•added 2019/04/04 4:29 p.m.•51 views

CVE-2019-1003086

A cross-site request forgery vulnerability in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server.

6.5CVSS6.3AI score0.00156EPSS

CVE•added 2019/04/04 4:29 p.m.•48 views

CVE-2019-1003087

A missing permission check in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.

6.5CVSS6.2AI score0.00084EPSS