DeutschShown in its original language — a full translation is planned for a future version.
Jenkins: Mehrere Schwachstellen
view advisory published 2022-05-17
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, vertrauliche Informationen offenzulegen und Daten zu manipulieren.
01
describes (29)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-30972US | high8.8 | — | ||
A cross-site request forgery (CSRF) vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse a local XML file (e.g., archived artifac… | ||||
| CVE-2022-30971US | high8.8 | — | ||
Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. | ||||
| CVE-2022-30970US | medium5.4 | — | ||
Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names in an unsafe manner from Javascript embedd… | ||||
| CVE-2022-30969US | high8.8 | — | ||
A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute arbitrary code without sandbox protection if… | ||||
| CVE-2022-30968US | medium5.4 | — | ||
Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, resulting in a stored cross-site scripti… | ||||
| CVE-2022-30967US | medium5.4 | — | ||
Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on views displaying parameters, resulting in a… | ||||
| CVE-2022-30966US | medium5.4 | — | ||
Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views displaying parameters, resulting in a stored cr… | ||||
| CVE-2022-30965US | medium5.4 | — | ||
Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views displaying parameters, resulting in a stored… | ||||
| CVE-2022-30964US | medium5.4 | — | ||
Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views displaying parameters, resulting in a stored cross-… | ||||
| CVE-2022-30963US | medium5.4 | — | ||
Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters, resulting in a stored cross-site scripting (… | ||||
| CVE-2022-30962US | medium5.4 | — | ||
Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Variable String parameters on views displaying parameters, result… | ||||
| CVE-2022-30961US | medium5.4 | — | ||
Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String parameters on views displaying parameters, resultin… | ||||
| CVE-2022-30960US | medium5.4 | — | ||
Jenkins Application Detector Plugin 1.0.8 and earlier does not escape the name of Chois Application Version parameters on views displaying parameters, resulting in a stored cross-s… | ||||
| CVE-2022-30959US | medium6.5OT elevated | — | ||
A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-speci… | ||||
| CVE-2022-30958US | high8.8 | — | ||
A cross-site request forgery (CSRF) vulnerability in Jenkins SSH Plugin 2.6.1 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified c… | ||||
| CVE-2022-30957US | medium4.3OT elevated | — | ||
A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | ||||
| CVE-2022-30956US | medium5.4 | — | ||
Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable b… | ||||
| CVE-2022-30955US | medium6.5OT elevated | — | ||
Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of cr… | ||||
| CVE-2022-30954US | medium6.5OT elevated | — | ||
Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacke… | ||||
| CVE-2022-30953US | medium6.5 | — | ||
A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server. | ||||
showing 20 of 29
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2023:0017 vom 2023-01-12external
- Red Hat Security Advisory RHSA-2023:0560 vom 2023-02-08external
- Red Hat Security Advisory RHSA-2023:0777 vom 2023-02-23external
- Red Hat Security Advisory RHSA-2023:1064 vom 2023-03-06external
- Red Hat Security Advisory RHSA-2023:3198 vom 2023-05-18external
- Red Hat Security Advisory RHSA-2023:3610 vom 2023-06-15external
- Red Hat Security Advisory RHSA-2023:3622 vom 2023-06-15external
- WID-SEC-W-2023-0090 - CSAF Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan