Jenkins
Jenkins Security Advisory 2019-03-25
2019-03-25 Mar 25, 2019 Source: Vendor
Imported by the Jenkins advisory catcher from https://www.jenkins.io/security/advisory/2019-03-25/. 8 SECURITY issues listed. Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.jenkins.io/security/advisory/2019-03-25/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
8 lines
Showing 1–8 of 8
CVE-2019-1003040
BR2019-0000-020086
SECURITY-1353
unclaimed
Sandbox bypass in Script Security Plugin and Pipeline: Groovy Plugin
Credited as Anthony Weems, Praetorian
Acknowledgement
BR2019-0000-020087
SECURITY-1328
unclaimed
Unprivileged users with Overall/Read access were able to enumerate credential IDs in Arxan MAM Publisher Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2019-1003042
BR2019-0000-020088
SECURITY-1361
unclaimed
XSS vulnerability in Lockable Resources Plugin
Credited as Jesper den Boer
CVE-2019-1003045
BR2019-0000-020089
SECURITY-846
unclaimed
ECS Publisher Plugin stored and displayed API token in plain text
Credited as Viktor Gazdag
CVE-2019-1003043
BR2019-0000-020090
SECURITY-976
unclaimed
CSRF vulnerability and missing permission checks in Slack Notification Plugin allowed capturing credentials
Credited as Viktor Gazdag
CVE-2019-1003046
BR2019-0000-020091
SECURITY-992
unclaimed
SSRF vulnerability due to missing permission check in Fortify on Demand Uploader Plugin
Credited as Viktor Gazdag
Acknowledgement
BR2019-0000-020092
SECURITY-1086
unclaimed
Codebeamer Test Results Trend Updater Plugin stored password in plain text
Credited as Viktor Gazdag
CVE-2019-1003048
BR2019-0000-020093
SECURITY-1089
unclaimed
PRQA Plugin stored password in plain text
Credited as Viktor Gazdag