Jenkins
Jenkins Security Advisory 2023-07-26
2023-07-26 Jul 26, 2023 Source: Vendor
Imported by the Jenkins advisory catcher from https://www.jenkins.io/security/advisory/2023-07-26/. 7 SECURITY issues listed. Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.jenkins.io/security/advisory/2023-07-26/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
7 lines
Showing 1–7 of 7
CVE-2023-3414
BR2023-0000-009806
SECURITY-3129
unclaimed
CSRF vulnerability and missing permission check in ServiceNow DevOps Plugin allow capturing credentials
Credited as Alvaro Muñoz (@pwntester), GitHub Security Lab
CVE-2023-39155
BR2023-0000-009807
SECURITY-3192
unclaimed
Secret displayed without masking by Chef Identity Plugin
Credited as Andrea Chiera, CloudBees, Inc.
CVE-2023-39156
BR2023-0000-009808
SECURITY-3095
unclaimed
CSRF vulnerability in Bazaar Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-39151
BR2023-0000-009809
SECURITY-3188
unclaimed
Stored XSS vulnerability
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-39151
BR2023-0000-009810
SECURITY-3188
unclaimed
Stored XSS vulnerability
Credited as Devin Nusbaum, CloudBees, Inc.
CVE-2023-39153
BR2023-0000-009811
SECURITY-2696
unclaimed
CSRF vulnerability in GitLab Authentication Plugin
Credited as Wadeck Follonier, CloudBees Inc.
CVE-2023-39154
BR2023-0000-009812
SECURITY-3012
unclaimed
Incorrect permission checks in Qualys Web App Scanning Connector Plugin allow capturing credentials
Credited as Yaroslav Afenkin, CloudBees, Inc.