DeutschShown in its original language — a full translation is planned for a future version.
Jenkins: Mehrere Schwachstellen
view advisory published 2022-04-12
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, einen Cross-Site-Scripting-Angriff durchzuführen und Dateien zu manipulieren.
01
describes (18)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-29052US | medium4.3 | — | ||
Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins controller where they can be viewed by users w… | ||||
| CVE-2022-29051US | medium4.3OT elevated | — | ||
Missing permission checks in Jenkins Publish Over FTP Plugin 1.16 and earlier allow attackers with Overall/Read permission to connect to an FTP server using attacker-specified cred… | ||||
| CVE-2022-29050US | high8.8 | — | ||
A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over FTP Plugin 1.16 and earlier allows attackers to connect to an FTP server using attacker-specified credenti… | ||||
| CVE-2022-29049US | medium5.4 | — | ||
Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL, allowing attackers with Job/Configure pe… | ||||
| CVE-2022-29048US | medium4.3 | — | ||
A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to connect to an attacker-specified URL. | ||||
| CVE-2022-29047US | medium5.3OT elevated | — | ||
Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent), but not able to com… | ||||
| CVE-2022-29046US | medium5.4 | — | ||
Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a s… | ||||
| CVE-2022-29045US | medium5.4 | — | ||
Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not escape the name and description of Promoted Build parameters on views displaying parameters,… | ||||
| CVE-2022-29044US | medium5.4 | — | ||
Jenkins Node and Label parameter Plugin 1.10.3 and earlier does not escape the name and description of Node and Label parameters on views displaying parameters, resulting in a stor… | ||||
| CVE-2022-29043US | medium5.4 | — | ||
Jenkins Mask Passwords Plugin 3.0 and earlier does not escape the name and description of Non-Stored Password parameters on views displaying parameters, resulting in a stored cross… | ||||
| CVE-2022-29042US | medium5.4 | — | ||
Jenkins Job Generator Plugin 1.22 and earlier does not escape the name and description of Generator Parameter and Generator Choice parameters on Job Generator jobs' Build With Para… | ||||
| CVE-2022-29041US | medium5.4 | — | ||
Jenkins Jira Plugin 3.7 and earlier, except 3.6.1, does not escape the name and description of Jira Issue and Jira Release Version parameters on views displaying parameters, result… | ||||
| CVE-2022-29040US | medium5.4 | — | ||
Jenkins Git Parameter Plugin 0.9.15 and earlier does not escape the name and description of Git parameters on views displaying parameters, resulting in a stored cross-site scriptin… | ||||
| CVE-2022-29039US | medium5.4 | — | ||
Jenkins Gerrit Trigger Plugin 2.35.2 and earlier does not escape the name and description of Base64 Encoded String parameters on views displaying parameters, resulting in a stored… | ||||
| CVE-2022-29038US | medium5.4 | — | ||
Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the name and description of Extended Choice parameters on views displaying parameters, resul… | ||||
| CVE-2022-29037US | medium5.4 | — | ||
Jenkins CVS Plugin 2.19 and earlier does not escape the name and description of CVS Symbolic Name parameters on views displaying parameters, resulting in a stored cross-site script… | ||||
| CVE-2022-29036US | medium5.4 | — | ||
Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name and description of Cr… | ||||
| CVE-2017-2601US | medium5.4 | — | ||
Jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in parameter names and descriptions (SECURITY-353). Users with the permission to configure jo… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2022:2205 vom 2022-05-19external
- Red Hat Security Advisory RHSA-2022:2280 vom 2022-05-31external
- Red Hat Security Advisory RHSA-2022:2281 vom 2022-05-31external
- Red Hat Security Advisory RHSA-2022:4909 vom 2022-06-10external
- Red Hat Security Advisory RHSA-2022:4947 vom 2022-06-17external
- Red Hat Security Advisory RHSA-2023:0017 vom 2023-01-12external
- Red Hat Security Advisory RHSA-2023:1064 vom 2023-03-06external
- WID-SEC-W-2022-0265 - CSAF Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan