DeutschShown in its original language — a full translation is planned for a future version.
Jenkins: Mehrere Schwachstellen
view advisory published 2022-06-22
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion.
01
describes (45)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-34213US | medium6.5 | — | ||
Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be view… | ||||
| CVE-2022-34212US | medium5.7OT elevated | — | ||
A missing permission check in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request to an attacker-specifi… | ||||
| CVE-2022-34211US | medium6.5 | — | ||
A cross-site request forgery (CSRF) vulnerability in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers to send an HTTP POST request to an attacker-specified URL… | ||||
| CVE-2022-34210US | medium6.5OT elevated | — | ||
A missing permission check in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. | ||||
| CVE-2022-34209US | medium6.5 | — | ||
A cross-site request forgery (CSRF) vulnerability in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers to connect to an attacker-specified URL. | ||||
| CVE-2022-34208US | medium4.3OT elevated | — | ||
A missing permission check in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. | ||||
| CVE-2022-34207US | medium6.5 | — | ||
A cross-site request forgery (CSRF) vulnerability in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers to connect to an attacker-specified URL. | ||||
| CVE-2022-34206US | medium4.3OT elevated | — | ||
A missing permission check in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers with Overall/Read permission to send HTTP POST requests to an attacker-specified… | ||||
| CVE-2022-34205US | medium6.5 | — | ||
A cross-site request forgery (CSRF) vulnerability in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers to send HTTP POST requests to an attacker-specified URL. | ||||
| CVE-2022-34204US | medium4.3OT elevated | — | ||
A missing permission check in Jenkins EasyQA Plugin 1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server. | ||||
| CVE-2022-34203US | high8.8 | — | ||
A cross-site request forgery (CSRF) vulnerability in Jenkins EasyQA Plugin 1.0 and earlier allows attackers to connect to an attacker-specified HTTP server. | ||||
| CVE-2022-34202US | medium6.5 | — | ||
Jenkins EasyQA Plugin 1.0 and earlier stores user passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to… | ||||
| CVE-2022-34201US | medium6.5OT elevated | — | ||
A missing permission check in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. | ||||
| CVE-2022-34200US | high8.8 | — | ||
A cross-site request forgery (CSRF) vulnerability in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers to connect to an attacker-specified URL. | ||||
| CVE-2022-34199US | medium6.5 | — | ||
Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Exte… | ||||
| CVE-2022-34198US | medium5.4 | — | ||
Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier does not escape the name and description of Stash Branch parameters on views displaying parameters, resulting in a stored cr… | ||||
| CVE-2022-34197US | medium5.4 | — | ||
Jenkins Sauce OnDemand Plugin 1.204 and earlier does not escape the name and description of Sauce Labs Browsers parameters on views displaying parameters, resulting in a stored cro… | ||||
| CVE-2022-34196US | medium5.4 | — | ||
Jenkins REST List Parameter Plugin 1.5.2 and earlier does not escape the name and description of REST list parameters on views displaying parameters, resulting in a stored cross-si… | ||||
| CVE-2022-34195US | medium5.4 | — | ||
Jenkins Repository Connector Plugin 2.2.0 and earlier does not escape the name and description of Maven Repository Artifact parameters on views displaying parameters, resulting in… | ||||
| CVE-2022-34194US | medium5.4 | — | ||
Jenkins Readonly Parameter Plugin 1.0.0 and earlier does not escape the name and description of Readonly String and Readonly Text parameters on views displaying parameters, resulti… | ||||
showing 20 of 45
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2022:6531 vom 2022-09-21external
- Red Hat Security Advisory RHSA-2022:9110 vom 2023-01-06external
- Red Hat Security Advisory RHSA-2022:9111 vom 2023-01-06external
- Red Hat Security Advisory RHSA-2023:0017 vom 2023-01-12external
- Red Hat Security Advisory RHSA-2023:0697 vom 2023-02-16external
- Red Hat Security Advisory RHSA-2023:0698 vom 2023-02-15external
- Red Hat Security Advisory RHSA-2023:0777 vom 2023-02-23external
- WID-SEC-W-2022-0445 - CSAF Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan