CVE-2023-30523

Jenkins Report Portal Plugin versions 0.5 and earlier are affected by CVE-2023-30523. The vulnerability stems from storing ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controller, enabling viewing by users with Item/Extended Read permission or anyone with access t...

CVE-2023-30526

CVE-2023-30526 affects Jenkins Report Portal Plugin 0.5 and earlier. A missing permission check in a method handling form validation (and related CSRF context) allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified bearer token authenticatio...

CVE-2023-30524

CVE-2023-30524 affects Jenkins' Report Portal Plugin 0.5 and earlier. The vulnerability stems from tokens being stored in plaintext in job config.xml on the Jenkins controller and from the configuration form not masking those tokens, enabling users with certain permissions or access to the filesy...

CVE-2023-30525

CVE-2023-30525 describes a CSRF vulnerability in Jenkins Report Portal Plugin versions 0.5 and earlier. The root cause is a missing permission check in a form-validation method, which can be abused to connect to an attacker-specified URL using an attacker-specified bearer token. This vulnerabilit...