CVE-2022-28145

CVE-2022-28145 concerns Jenkins with the Toad Edge Plugin (version 2.3 and earlier). The published descriptions state that this plugin does not apply Content-Security-Policy headers to report files it serves, enabling a stored XSS vulnerability. This can be exploited by attackers who have Item/Co...

CVE-2022-28146

The CVE-2022-28146 issue affects Jenkins Continuous Integration with Toad Edge Plugin, version 2.3 and earlier. Vulnerability: the plugin allows attackers with Item/Configure permission to read arbitrary files on the Jenkins controller by passing an input folder as a parameter to build steps. Thi...

CVE-2022-28147

CVE-2022-28147 affects Jenkins Continuous Integration with Toad Edge Plugin (version 2.3 and earlier). The impact is a missing permission check that lets an attacker with Overall/Read permission verify the existence of an attacker-specified file path on the Jenkins controller filesystem. The prov...

CVE-2022-28148

CVE-2022-28148 affects Jenkins Continuous Integration with Toad Edge Plugin (versions 2.3 and earlier). The file browser may treat certain file paths as absolute on Windows, creating a path traversal that could allow attackers with Item/Read permission to read arbitrary files on Windows controlle...