CVE-2022-34204

The CVE-2022-34204 entry concerns Jenkins EasyQA Plugin (versions 1.0 and earlier). A missing permission check in the plugin’s form-validation path allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server, with CSRF also discussed in related advisories. Public...

CVE-2022-34202

CVE-2022-34202 affects Jenkins EasyQA Plugin 1.0 and earlier. The vulnerability arises because the plugin stores user passwords unencrypted in the global configuration file EasyQAPluginProperties.xml on the Jenkins controller, making them viewable to anyone with access to the controller file syst...

CVE-2022-34203

CVE-2022-34203 is a CSRF vulnerability in Jenkins EasyQA Plugin 1.0 and earlier. The Nessus/NVD entries describe that an attacker can abuse a form-validation flow to connect to an attacker-specified HTTP server, due to missing permission checks in the plugin’s processing. The vulnerability is tie...