CVE-2023-3315

CVE-2023-3315 affects the Jenkins Team Concert Plugin (versions 2.4.1 and earlier). Root cause: missing permission checks in methods implementing form validation, enabling a remote authenticated attacker with Overall/Read to check for the existence of an attacker-specified file path on the Jenkin...

CVE-2019-16567

CVE-2019-16567 affects Jenkins Team Concert Plugin 1.3.0 and earlier. A missing permission check in form-related methods lets users with Overall/Read access enumerate credential IDs stored in Jenkins. Impact: credential enumeration; no exploitation details provided. Mitigation: upgrade/patch to a...

CVE-2019-16566

CVE-2019-16566 affects Jenkins Team Concert Plugin versions 1.3.0 and earlier. The root cause is a missing permission check in a form/URL handling path that allows attackers with Overall/Read access to initiate connections to an attacker-specified URL using attacker-specified credentials IDs, ena...

CVE-2019-16565

Jenkins Team Concert Plugin 1.3.0 and earlier is vulnerable to cross‑site request forgery due to missing permission checks on a form validation method. This flaw allows an attacker with some Jenkins access to cause the server to connect to an attacker‑supplied URL using attacker‑supplied credenti...