Jenkins
Jenkins Security Advisory 2023-07-12
2023-07-12 Jul 12, 2023 Source: Vendor
Imported by the Jenkins advisory catcher from https://www.jenkins.io/security/advisory/2023-07-12/. 17 SECURITY issues listed. Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.jenkins.io/security/advisory/2023-07-12/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
20 lines
Showing 1–20 of 20
CVE-2023-37958
BR2023-0000-009813
SECURITY-3117
unclaimed
CSRF vulnerability and missing permission checks in Sumologic Publisher Plugin
Credited as Alvaro Muñoz (@pwntester), GitHub Security Lab
CVE-2023-37962
BR2023-0000-009814
SECURITY-3119
unclaimed
CSRF vulnerability and missing permission checks in Benchmark Evaluator Plugin
Credited as Alvaro Muñoz (@pwntester), GitHub Security Lab
CVE-2023-37955
BR2023-0000-009815
SECURITY-3122
unclaimed
CSRF vulnerability and missing permission check in Test Results Aggregator Plugin
Credited as Alvaro Muñoz (@pwntester), GitHub Security Lab
CVE-2023-37957
BR2023-0000-009816
SECURITY-3126
unclaimed
CSRF vulnerability in Pipeline restFul API Plugin
Credited as Alvaro Muñoz (@pwntester), GitHub Security Lab
CVE-2023-37952
BR2023-0000-009817
SECURITY-3127
unclaimed
CSRF vulnerability and missing permission checks in mabl Plugin allow capturing credentials
Credited as Alvaro Muñoz (@pwntester), GitHub Security Lab
CVE-2023-37949
BR2023-0000-009818
SECURITY-3128
unclaimed
Missing permission check in Orka by MacStadium Plugin allows capturing credentials
Credited as Alvaro Muñoz (@pwntester), GitHub Security Lab
CVE-2023-37944
BR2023-0000-009819
SECURITY-3130
unclaimed
Missing permission check in Datadog Plugin allows capturing credentials
Credited as Alvaro Muñoz (@pwntester), GitHub Security Lab
CVE-2023-37964
BR2023-0000-009820
SECURITY-3131
unclaimed
CSRF vulnerability and missing permission checks in ElasticBox CI Plugin allow capturing credentials
Credited as Alvaro Muñoz (@pwntester), GitHub Security Lab
CVE-2023-37945
BR2023-0000-009821
SECURITY-3164
unclaimed
Missing permission check in SAML Single Sign On(SSO) Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2023-37961
BR2023-0000-009822
SECURITY-2988
unclaimed
CSRF vulnerability in Assembla Auth Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-37954
BR2023-0000-009823
SECURITY-3033
unclaimed
CSRF vulnerability in Rebuilder Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
Acknowledgement
BR2023-0000-009824
SECURITY-3137
unclaimed
SECURITY-3137
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-37946
BR2023-0000-009825
SECURITY-2998
unclaimed
Session fixation vulnerability in OpenShift Login Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-37946
BR2023-0000-009826
SECURITY-2998
unclaimed
Session fixation vulnerability in OpenShift Login Plugin
Credited as Yaroslav Afenkin, CloudBees, Inc.
CVE-2023-37947
BR2023-0000-009827
SECURITY-2999
unclaimed
Open redirect vulnerability in OpenShift Login Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-37947
BR2023-0000-009828
SECURITY-2999
unclaimed
Open redirect vulnerability in OpenShift Login Plugin
Credited as Yaroslav Afenkin, CloudBees, Inc.
CVE-2023-37960
BR2023-0000-009829
SECURITY-3124
unclaimed
Arbitrary file read vulnerability in MathWorks Polyspace Plugin
Credited as Tony Torralba (@atorralba), GitHub Security Lab
CVE-2023-37942
BR2023-0000-009830
SECURITY-3133
unclaimed
XXE vulnerability in External Monitor Job Type Plugin
Credited as Tony Torralba (@atorralba), GitHub Security Lab
CVE-2023-37948
BR2023-0000-009831
SECURITY-3044
unclaimed
Missing SSH host key validation in Oracle Cloud Infrastructure Compute Plugin
Credited as Yaroslav Afenkin, CloudBees, Inc.
Acknowledgement
BR2023-0000-009832
SECURITY-3137
unclaimed
SECURITY-3137
Credited as Yaroslav Afenkin, CloudBees, Inc.