Jenkins
Jenkins Security Advisory 2022-02-15
2022-02-15 Feb 15, 2022 Source: Vendor
Imported by the Jenkins advisory catcher from https://www.jenkins.io/security/advisory/2022-02-15/. 27 SECURITY issues listed. Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.jenkins.io/security/advisory/2022-02-15/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
24 lines
Showing 1–24 of 24
CVE-2022-25207
BR2022-0000-011796
SECURITY-1377
unclaimed
CSRF vulnerability and missing permission checks in Chef Sinatra Plugin allow XXE
Credited as Daniel Beck, CloudBees, Inc.
CVE-2022-25182
BR2022-0000-011797
SECURITY-2422
unclaimed
Sandbox bypass vulnerability in Pipeline: Deprecated Groovy Libraries Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2022-25186
BR2022-0000-011798
SECURITY-2429
unclaimed
Agent-to-controller security bypass in HashiCorp Vault Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2022-25173
BR2022-0000-011799
SECURITY-2463
unclaimed
OS command execution vulnerabilities in Pipeline-related plugins
Credited as Daniel Beck, CloudBees, Inc.
CVE-2022-25197
BR2022-0000-011800
SECURITY-2521
unclaimed
Agent-to-controller security bypass in HashiCorp Vault Plugin allows reading arbitrary files
Credited as Daniel Beck, CloudBees, Inc.
CVE-2022-25192
BR2022-0000-011801
SECURITY-2536
unclaimed
CSRF vulnerability and missing permission checks in Snow Commander Plugin allow capturing credentials
Credited as Daniel Beck, CloudBees, Inc.
CVE-2022-25194
BR2022-0000-011802
SECURITY-2545
unclaimed
CSRF vulnerability and missing permission check in autonomiq Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2022-25204
BR2022-0000-011803
SECURITY-2548
unclaimed
Agent-to-controller security bypass vulnerability in Doktor Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2022-25176
BR2022-0000-011804
SECURITY-2613
unclaimed
Vulnerabilities in multiple Pipeline-related plugins allow reading arbitrary files on the controller
Credited as Daniel Beck, CloudBees, Inc.
CVE-2022-25183
BR2022-0000-011805
SECURITY-2586
unclaimed
Sandbox bypass vulnerability in Pipeline: Deprecated Groovy Libraries Plugin
Credited as Devin Nusbaum, CloudBees, Inc.
CVE-2022-25196
BR2022-0000-011806
SECURITY-1833
unclaimed
Open redirect vulnerability in GitLab Authentication Plugin
Credited as James Nord, CloudBees, Inc.
CVE-2022-25187
BR2022-0000-011807
SECURITY-2186
unclaimed
Sensitive data stored in plain text by Support Core Plugin
Credited as James Nord, CloudBees, Inc.
CVE-2022-25180
BR2022-0000-011808
SECURITY-2443
unclaimed
Sensitive information disclosure in Pipeline: Groovy Plugin
Credited as James Nord, CloudBees, Inc.
CVE-2022-25203
BR2022-0000-011809
SECURITY-2324
unclaimed
Stored XSS vulnerability in Team Views Plugin
Credited as Justin Philip
CVE-2022-25202
BR2022-0000-011810
SECURITY-2334
unclaimed
Stored XSS vulnerability in Promoted Builds (Simple) Plugin
Credited as Justin Philip
CVE-2022-25189
BR2022-0000-011811
SECURITY-2266
unclaimed
Stored XSS vulnerability in Custom Checkbox Parameter Plugin
Credited as Kevin Guerroudj
CVE-2022-25191
BR2022-0000-011812
SECURITY-2268
unclaimed
Stored XSS vulnerability in Agent Server Parameter Plugin
Credited as Kevin Guerroudj
CVE-2022-25198
BR2022-0000-011813
SECURITY-2323
unclaimed
CSRF vulnerability and missing permission check in SCP publisher Plugin
Credited as Kevin Guerroudj, Justin Philip, Marc Heyries
CVE-2022-25188
BR2022-0000-011814
SECURITY-2214
unclaimed
Path traversal vulnerability in Fortify Plugin
Credited as Matt Sicker, CloudBees, Inc.
CVE-2022-25200
BR2022-0000-011815
SECURITY-1017
unclaimed
CSRF vulnerability and missing permission checks in Checkmarx Plugin allow capturing credentials
Credited as Oleg Nenashev
CVE-2022-25211
BR2022-0000-011816
SECURITY-1988
unclaimed
CSRF vulnerability and missing permission check in SWAMP Plugin allows capturing credentials
Credited as Wadeck Follonier, CloudBees, Inc.
CVE-2022-25205
BR2022-0000-011817
SECURITY-2177
unclaimed
CSRF vulnerability and missing permission checks in dbCharts Plugin
Credited as Wadeck Follonier, CloudBees, Inc.
CVE-2022-25210
BR2022-0000-011818
SECURITY-2280
unclaimed
Missing synchronization vulnerability in Convertigo Mobile Platform Plugin allow to capture passwords
Credited as Wadeck Follonier, CloudBees, Inc.
CVE-2022-25181
BR2022-0000-011819
SECURITY-2441
unclaimed
Sandbox bypass vulnerability in Pipeline: Deprecated Groovy Libraries Plugin
Credited as Wadeck Follonier, CloudBees, Inc.