CVE-2020-2147

CVE-2020-2147 affects the Jenkins Mac Plugin, specifically versions 1.1.0 and earlier. The issue is a cross-site request forgery (CSRF) that allows an attacker to cause the plugin to connect to an attacker-specified SSH server using attacker-specified credentials. The published metrics list a CVS...

CVE-2020-2146

Summary (CVE-2020-2146) : Jenkins Mac Plugin, versions 1.1.0 and earlier, does not validate SSH host keys when connecting agents, enabling man-in-the-middle attacks. This behavior is confirmed across multiple sources in the provided documents. Impact : lack of host-key validation could allow inte...

CVE-2020-2148

CVE-2020-2148 affects Jenkins Mac Plugin (versions 1.1.0 and earlier). The root cause is a missing permission check that allows attackers with Overall/Read to connect to an attacker-specified SSH server using attacker-specified credentials. The connected documents confirm the vulnerability detail...