DeutschShown in its original language — a full translation is planned for a future version.
Jenkins: Mehrere Schwachstellen
view advisory published 2023-02-15
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Cross-Site-Scripting-Angriff durchzuführen.
01
describes (11)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-23850US | medium4.3OT elevated | — | ||
A missing permission check in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in… | ||||
| CVE-2023-23848US | medium4.3OT elevated | — | ||
Missing permission checks in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using a… | ||||
| CVE-2023-23847US | low3.5 | — | ||
A cross-site request forgery (CSRF) vulnerability in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers to connect to an attacker-specified HTTP server using attac… | ||||
| CVE-2023-25768US | medium6.5OT elevated | — | ||
A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web s… | ||||
| CVE-2023-25767US | high8.8 | — | ||
A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers to connect to an attacker-specified web server. | ||||
| CVE-2023-25766US | medium4.3OT elevated | — | ||
A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentia… | ||||
| CVE-2023-25765US | critical9.9 | — | ||
In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able to define email templa… | ||||
| CVE-2023-25764US | medium5.4 | — | ||
Jenkins Email Extension Plugin 2.93 and earlier does not escape, sanitize, or sandbox rendered email template output or log output generated during template rendering, resulting in… | ||||
| CVE-2023-25763US | medium5.4 | — | ||
Jenkins Email Extension Plugin 2.93 and earlier does not escape various fields included in bundled email templates, resulting in a stored cross-site scripting (XSS) vulnerability e… | ||||
| CVE-2023-25762US | medium5.4 | — | ||
Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site s… | ||||
| CVE-2023-25761US | medium5.4 | — | ||
Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2023:1866 vom 2023-04-26external
- Red Hat Security Advisory RHSA-2023:3195 vom 2023-05-19external
- Red Hat Security Advisory RHSA-2023:3198 vom 2023-05-18external
- Red Hat Security Advisory RHSA-2023:3299 vom 2023-05-24external
- Red Hat Security Advisory RHSA-2024:0775 vom 2024-02-12external
- Red Hat Security Advisory RHSA-2024:0776 vom 2024-02-12external
- Red Hat Security Advisory RHSA-2024:0777 vom 2024-02-12external
- Red Hat Security Advisory RHSA-2024:0778 vom 2024-02-12external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan