BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Jenkins

Jenkins Security Advisory 2022-10-19

2022-10-19 Oct 19, 2022 Source: Vendor

Imported by the Jenkins advisory catcher from https://www.jenkins.io/security/advisory/2022-10-19/. 26 SECURITY issues listed. Draft. Review before publishing.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://www.jenkins.io/security/advisory/2022-10-19/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

23 lines
All 23 CVEs 21 Additional recognition 2 Unclaimed only
Showing 1–23 of 23
CVE-2022-43426 BR2022-0000-010118 SECURITY-2480 unclaimed
AWS secrets displayed without masking by S3 Explorer Plugin
Credited as Bram Mertens, Astadia
CVE-2022-43414 BR2022-0000-010119 SECURITY-2551 unclaimed
Agent-to-controller security bypass vulnerability in NUnit Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2022-43408 BR2022-0000-010120 SECURITY-2828 unclaimed
CSRF protection for any URL can be bypassed in Pipeline: Stage View Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2022-43416 BR2022-0000-010121 SECURITY-2844 unclaimed
Agent-to-controller security bypass vulnerability in Katalon Plugin
Credited as Daniel Beck, CloudBees, Inc.
Acknowledgement BR2022-0000-010122 SECURITY-2845 unclaimed
SECURITY-2845
Credited as Daniel Beck, CloudBees, Inc.
CVE-2022-43419 BR2022-0000-010123 SECURITY-2846 unclaimed
API keys stored in plain text by Katalon Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2022-43432 BR2022-0000-010124 SECURITY-2863 unclaimed
Content-Security-Policy protection for user content disabled by XFramium Builder Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2022-43433 BR2022-0000-010125 SECURITY-2864 unclaimed
Content-Security-Policy protection for user content disabled by ScreenRecorder Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2022-43434 BR2022-0000-010126 SECURITY-2865 unclaimed
Content-Security-Policy protection for user content disabled by NeuVector Vulnerability Scanner Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2022-43435 BR2022-0000-010127 SECURITY-2866 unclaimed
Content-Security-Policy protection for user content can be disabled in 360 FireLine Plugin
Credited as Daniel Beck, CloudBees, Inc.
Acknowledgement BR2022-0000-010128 SECURITY-2824 unclaimed
SECURITY-2824
Credited as Devin Nusbaum, CloudBees, Inc.
CVE-2022-43410 BR2022-0000-010129 SECURITY-2831 unclaimed
Webhook endpoint discloses job names to unauthorized users in Mercurial Plugin
Credited as Jeremy Norris (jeremy.norris@lbnetworks.co)
CVE-2022-43415 BR2022-0000-010130 SECURITY-2337 unclaimed
XXE vulnerability in REPO Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2022-43430 BR2022-0000-010131 SECURITY-2625 unclaimed
XXE vulnerability in BMC AMI DevX Total Test Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2022-43421 BR2022-0000-010132 SECURITY-2852 unclaimed
Lack of webhook authentication mechanism in Tuleap Git Branch Source Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2022-43407 BR2022-0000-010133 SECURITY-2880 unclaimed
CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2022-43409 BR2022-0000-010134 SECURITY-2881 unclaimed
Stored XSS vulnerability in Pipeline: Supporting APIs Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2022-43425 BR2022-0000-010135 SECURITY-2797 unclaimed
Stored XSS vulnerability in Custom Checkbox Parameter Plugin
Credited as Kevin Guerroudj, CloudBees, Inc., Wadeck Follonier, CloudBees, Inc.
CVE-2022-43425 BR2022-0000-010136 SECURITY-2797 unclaimed
Stored XSS vulnerability in Custom Checkbox Parameter Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2022-43413 BR2022-0000-010137 SECURITY-2791 unclaimed
Missing permission check in Job Import Plugin allows enumerating credentials IDs
Credited as Valdes Che Zogou, CloudBees, Inc.
CVE-2022-43420 BR2022-0000-010138 SECURITY-2836 unclaimed
Stored XSS vulnerability in Contrast Continuous Application Security Plugin
Credited as Valdes Che Zogou, CloudBees, Inc.
CVE-2022-43412 BR2022-0000-010139 SECURITY-2874 unclaimed
Non-constant time webhook token comparison in Generic Webhook Trigger Plugin
Credited as Yaroslav Afenkin, CloudBees, Inc.
CVE-2022-43411 BR2022-0000-010140 SECURITY-2877 unclaimed
Non-constant time webhook token comparison in GitLab Plugin
Credited as Yaroslav Afenkin, CloudBees, Inc.