CVE-2022-34782

Summary: CVE-2022-34782 is an authorization flaw in the Jenkins requests-plugin (version 2.2.16 and earlier) where attackers with Overall/Read permission can view the list of pending requests due to an incorrect permission check. Affected software: Jenkins requests-plugin, up to and including 2.2...

CVE-2021-21674

CVE-2021-21674 affects Jenkins with the requests-plugin (versions 2.2.6 and earlier). The root cause is a missing permission check on an HTTP endpoint, allowing attackers with Overall/Read permission to view the list of pending requests. The issue is mitigated by updating to version 2.2.7 or late...

CVE-2021-21675

Summary: CVE-2021-21675 is a CSRF vulnerability in Jenkins’ requests-plugin that affects versions 2.2.12 and earlier. The flaw arises because certain HTTP endpoints did not require POST, allowing attackers to craft requests or cause administrators to apply pending requests (e.g., renaming or dele...

CVE-2021-21676

Jenkins requests-plugin vulnerability CVE-2021-21676 affects the requests-plugin on Jenkins versions 2.2.7 and earlier. The issue is a missing permission check in an HTTP endpoint, which allows attackers with Overall/Read permission to trigger sending test emails to an attacker-specified address....