CVE-2022-34787

CVE-2022-34787 concerns Jenkins Project Inheritance Plugin, versions 21.04.03 and earlier. The vulnerability arises because the plugin does not escape the text explaining why a build is blocked in tooltips, enabling stored or reflected XSS if an attacker can control the blocked queue reason. Expl...

CVE-2020-2197

The vulnerability concerns the Jenkins Project Inheritance Plugin, affecting versions 21.04.03 and earlier (and specifically noted for 19.08.02 and earlier). Affected functionality via the API endpoint /job/…/getConfigAsXML does not enforce Job/ExtendedRead permission, allowing users with only Jo...

CVE-2020-2198

The CVE-2020-2198 issue affects the Jenkins Project Inheritance Plugin where encrypted secrets in a job’s config.xml are not redacted by the getConfigAsXML API when accessed by users without Job/Configure permissions. Multiple sources indicate this affects older plugin versions (e.g., 19.08.02 an...

CVE-2019-10408

The CVE refers to Jenkins Project Inheritance Plugin (2.0.0 and earlier) with a CSRF vulnerability caused by a missing permission check in the HTTP endpoint that triggers project creation from templates. This allowed users, potentially with limited access, to trigger project generation without pr...

CVE-2019-10409

The CVE concerns Jenkins Project Inheritance Plugin, affecting 2.0.0 and earlier. Root cause: missing permission check allows users with Overall/Read to trigger project generation from templates. Impact: unauthorized project creation without elevated privileges. Exploitation status is not detaile...

CVE-2019-10407

CVE-2019-10407 affects Jenkins Project Inheritance Plugin (versions 2.0.0 and earlier; also referenced as 19.08.02 and earlier in extended advisories). The vulnerability stems from the plugin displaying a list of environment variables passed to a build without masking sensitive variables contribu...