CVE-2022-36885

CVE-2022-36885 affects Jenkins GitHub Plugin 1.34.4 and earlier. The vulnerability arises from a non-constant time comparison when verifying webhook signatures, enabling attackers to use statistical methods to forge a valid webhook signature. Impact is limited to systems using the vulnerable plug...

CVE-2023-46650

The CVE-2023-46650 entry corresponds to a stored XSS vulnerability in Jenkins GitHub Plugin versions up to 1.37.3. The root cause is that the plugin does not escape the GitHub project URL on the build page when showing changes, enabling stored XSS attacks. Exploitation is possible by attackers wi...

CVE-2018-1000184

The CVE refers to a server-side request forgery in the Jenkins GitHub Plugin (versions ≤ 1.29.0) where the vulnerable code GitHubPluginConfig.java allows an attacker with Overall/Read access to trigger Jenkins to issue a GET request to an arbitrary URL. This SSRF impact is documented across multi...