DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Jenkins Plugins: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-06-24
Ein Angreifer kann mehrere Schwachstellen in Jenkins Plugins ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen und vertrauliche Informationen zu manipulieren oder offenzulegen.
01
beschreibt (28)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-57307US | —OT erhöht | — | ||
A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL… | ||||
| CVE-2026-57306US | medium4.2 | — | ||
A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers to connect to an attacker-specified URL using… | ||||
| CVE-2026-57305US | — | — | ||
A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL using an attacker-specified us… | ||||
| CVE-2026-57304US | —OT erhöht | — | ||
A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specif… | ||||
| CVE-2026-57303US | — | — | ||
Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the conf… | ||||
| CVE-2026-57302US | — | — | ||
Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permis… | ||||
| CVE-2026-57301US | — | — | ||
Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to… | ||||
| CVE-2026-57300US | —OT erhöht | — | ||
A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they… | ||||
| CVE-2026-57299US | medium4.3OT erhöht | — | ||
Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permission to enumerate the names of configu… | ||||
| CVE-2026-57298US | — | — | ||
A cross-site request forgery (CSRF) vulnerability in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers to have Jenkins connect to an attacke… | ||||
| CVE-2026-57297US | medium4.3OT erhöht | — | ||
A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-speci… | ||||
| CVE-2026-57296US | — | — | ||
Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided to the exwsAllocate Pipeline step, allowi… | ||||
| CVE-2026-57295US | — | — | ||
A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers to connect to an attacker-specified URL using at… | ||||
| CVE-2026-57294US | —OT erhöht | — | ||
A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL us… | ||||
| CVE-2026-57293US | —OT erhöht | — | ||
An incorrect permission check in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permiss… | ||||
| CVE-2026-57292US | — | — | ||
A cross-site request forgery (CSRF) vulnerability in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers to connect to an attacker-specified URL using attacker-… | ||||
| CVE-2026-57291US | —OT erhöht | — | ||
Missing permission checks in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using attac… | ||||
| CVE-2026-57290US | — | — | ||
A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to overwrite the global job priority configurati… | ||||
| CVE-2026-57289US | — | — | ||
Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token authentic… | ||||
| CVE-2026-57288US | — | — | ||
Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing u… | ||||
20 von 28 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Red Hat Security Advisory RHSA-2026:60239 vom 2026-08-26external
- Red Hat Security Advisory RHSA-2026:60246 vom 2026-08-26external
- Red Hat Security Advisory RHSA-2026:60247 vom 2026-08-26external
- Red Hat Security Advisory RHSA-2026:60248 vom 2026-08-26external
- Red Hat Security Advisory RHSA-2026:60249 vom 2026-08-26external
- Red Hat Security Advisory RHSA-2026:60250 vom 2026-08-26external
- Red Hat Security Advisory RHSA-2026:60251 vom 2026-08-26external
- Red Hat Security Advisory RHSA-2026:60252 vom 2026-08-26external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan