CVE-2022-34797

Summary (CVE-2022-34797) : Jenkins Deployment Dashboard Plugin versions 1.0.10 and earlier are vulnerable to a cross-site request forgery (CSRF) that lets an attacker connect to an attacker-specified HTTP URL using attacker-specified credentials. The issue is documented across multiple sources (N...

CVE-2022-34796

CVE-2022-34796 affects Jenkins Deployment Dashboard Plugin 1.0.10 and earlier. The root cause is a missing permission check on several HTTP endpoints, enabling attackers with Overall/Read permission to enumerate credential IDs stored in Jenkins, resulting in information disclosure. Practical impa...

CVE-2022-34798

CVE-2022-34798 affects Jenkins Deployment Dashboard Plugin (versions 1.0.10 and earlier). The issue is a missing permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials. This can ...

CVE-2022-34799

CVE-2022-34799 affects Jenkins Deployment Dashboard Plugin versions 1.0.10 and earlier. The vulnerability arises from storing a password unencrypted in the plugin’s global configuration file on the Jenkins controller (specifically de.codecentric.jenkins.dashboard.DashboardView.xml), which can be ...

CVE-2022-34795

CVE-2022-34795 affects Jenkins Deployment Dashboard Plugin (versions 1.0.10 and earlier). The vulnerability is a stored XSS due to environment names not being escaped in the Deployment Dashboard view, exploitable by attackers with View/Configure permission. Connected sources confirm the same desc...

CVE-2023-50775

CVE-2023-50775 describes a cross-site request forgery (CSRF) in Jenkins Deployment Dashboard Plugin, affecting version 1.0.10 and earlier. The connected Red Hat advisory and other sources confirm the vulnerability allows attackers to copy jobs on the Jenkins controller when the plugin is in use. ...