CVE-2022-36907

CVE-2022-36907 : Affected product is Jenkins OpenShift Deployer Plugin versions ≤ 1.2.0. The underlying issue is a missing permission check in a form-validation path, which allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and ...

CVE-2022-36908

The CVE-2022-36908 entry relates to a CSRF vulnerability in Jenkins OpenShift Deployer Plugin (versions 1.2.0 and earlier). The issue, described in multiple sources, allows an attacker to check for the existence of an attacker-specified file path on the Jenkins controller filesystem and to upload...

CVE-2022-36909

CVE-2022-36909 : A missing permission check in the Jenkins OpenShift Deployer Plugin (versions 1.2.0 and earlier) allows a user with Overall/Read to determine the existence of an attacker-specified file path on the Jenkins controller filesystem and to upload an SSH key file from the controller fi...

CVE-2022-36906

CVE-2022-36906 affects Jenkins OpenShift Deployer Plugin (1.2.0 and earlier). The root cause is a CSRF vulnerability in a form-validation path that does not perform proper permission checks, enabling an attacker to cause the controller to connect to an attacker-specified URL using attacker-specif...

CVE-2020-2155

CVE-2020-2155 affects Jenkins OpenShift Deployer Plugin (versions 1.2.0 and earlier). The root cause is that credentials are transmitted in plain text via the global Jenkins configuration form, potentially exposing them (e.g., through browser extensions or XSS). Credentials are stored encrypted o...

CVE-2019-1003081

The CVE describes a missing permission check in the Jenkins OpenShift Deployer Plugin, specifically in DeployApplication.DeployApplicationDescriptor#doCheckLogin form validation. Attackers with Overall/Read permission can trigger a connection to an attacker‑specified server, enabling potential un...

CVE-2019-1003080

Summary: CVE-2019-1003080 is a cross-site request forgery in the Jenkins OpenShift Deployer Plugin. The issue resides in DeployApplication.DeployApplicationDescriptor#doCheckLogin form validation, permitting an attacker to cause the plugin to connect to an attacker‑specified server. Public source...