CVE-2022-27198

CVE-2022-27198 is a CSRF vulnerability in Jenkins CloudBees AWS Credentials Plugin (versions up to 189.v3551d5642995 and earlier). It allows attackers with Overall/Read permission to perform actions against AWS services using an attacker-specified token. The connected advisories confirm the issue...

CVE-2022-27199

CVE-2022-27199 corresponds to a vulnerability in Jenkins CloudBees AWS Credentials Plugin (versions 189.v3551d5642995 and earlier) caused by a missing permission check. This flaw lets attackers with Overall/Read permission connect to an AWS service using an attacker-specified token, as described ...

CVE-2021-21625

CVE-2021-21625 affects Jenkins CloudBees AWS Credentials Plugin, version 1.28 and earlier. The underlying issue is a missing permission check in a helper method for HTTP endpoints, enabling attackers with Overall/Read permission to enumerate AWS credentials IDs stored in Jenkins under certain con...