CVE-2023-4301

CVE-2023-4301 is a CSRF vulnerability in Jenkins Fortify Plugin (versions 22.1.38 and earlier). The issue arises because the plugin does not perform permission checks on several HTTP endpoints and endpoints do not require POST requests. This allows attackers with Overall/Read permission to connec...

CVE-2023-4303

CVE-2023-4303 affects the Jenkins Fortify Plugin (versions 22.1.38 and earlier). The root issue is that the plugin does not escape the error message for a form validation method, which leads to an HTML injection vulnerability. Public sources confirm that Fortify Plugin 22.2.39 introduces a fix by...

CVE-2023-4302

CVE-2023-4302 affects Jenkins Fortify Plugin 22.1.38 and earlier. A missing permission check in multiple HTTP endpoints allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs, potentially capturing credentials stored in Jenki...

CVE-2022-25188

CVE-2022-25188 affects Jenkins Fortify Plugin 20.2.34 and earlier. The root cause is that the plugin does not sanitize the appName and appVersion parameters of its Pipeline steps, enabling attackers with Item/Configure permission to write or overwrite .xml files on the Jenkins controller filesyst...

CVE-2020-2107

CVE-2020-2107 affects Jenkins Fortify Plugin versions 19.1.29 and earlier. The issue is that proxy server passwords are stored unencrypted in job config.xml on the Jenkins master and can be read by users with Extended Read permission or access to the master filesystem. Impact is exposure of crede...