CVE-2022-29046

CVE-2022-29046 affects the Jenkins Subversion Plugin (2.15.3 and earlier). The stored XSS originates from insufficient escaping of the List Subversion tags (and related) parameters on parameter-displaying views, enabling an attacker with Item/Configure permission to inject scripts. Public referen...

CVE-2020-2304

CVE-2020-2304 affects Jenkins Subversion Plugin

CVE-2021-21698

CVE-2021-21698 affects Jenkins Subversion Plugin up to version 2.15.0. The issue arises because the plugin does not restrict the file name when resolving the subversion key file on the controller from an agent, enabling path traversal to read arbitrary files on the Jenkins controller when an atta...

CVE-2022-29048

CVE-2022-29048 is a CSRF vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier. The issue allows attackers to cause the application to connect to an attacker-specified URL. Public documents in the connected set confirm the plugin version range and the CSRF nature, but do not provide patch...

CVE-2020-2111

CVE-2020-2111 affects the Jenkins Subversion Plugin (versions ≤ 2.13.0). The vulnerability is a stored cross-site scripting (XSS) in the Project Repository Base URL field validation due to improper escaping of error messages. The issue is fixed in Jenkins Subversion Plugin 2.13.1, which escapes t...

CVE-2017-1000085

CVE-2017-1000085 affects the Jenkins Subversion Plugin. The vulnerability arises when the Subversion plugin connects to a user-specified repository during form validation, bypassing Item/Configure permissions and allowing users with Item/Build permission (but not Item/Configure) to have the plugi...

CVE-2018-1000111

CVE-2018-1000111 affects the Jenkins Subversion Plugin (versions 2.10.2 and earlier). The root cause is improper authorization in SubversionStatus.java and SubversionRepositoryStatus.java, enabling an attacker with network access to obtain a list of nodes and users. The vulnerability enables info...