warnings Plugin 5.0.1 and earlier does not require POST requests for a form validation method intended for testing custom warnings parsers, resulting in a cross-site request forgery (CSRF) vulnerability.
This vulnerability allows attackers to execute a…
[org.jenkins-ci.plugins:elastest] Passwords stored in plain text by ElasTest Plugin
Jenkins ElasTest Plugin 1.2.1 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
References
https://nvd.nist….
[org.jenkins-ci.plugins:elastest] Missing permission checks in ElasTest Plugin
A missing permission check in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-22…
[org.jenkins-ci.plugins:elastest] CSRF vulnerability in ElasTest Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-2273
htt…
[org.jvnet.hudson.plugins:copy-data-to-workspace-plugin] Arbitrary file read vulnerability in Copy data to workspace Jenkins Plugin
Jenkins Copy data to workspace Plugin 1.0 and earlier does not limit which directories can be copied from the Jenkins controller to job workspaces, allowing attackers with Job/Configure permission to read arbitrary files on the Jenkins controller.
Refe…
[org.jvnet.hudson.plugins:storable-configs-plugin] Arbitrary file write vulnerability in Storable Configs Plugin
Jenkins Storable Configs Plugin 1.0 and earlier does not restrict the user-specified file name, allowing attackers with Job/Configure permission to replace any other ‘.xml’ file on the Jenkins controller with a job config.xml file’s content.
References…
[org.jvnet.hudson.plugins:storable-configs-plugin] Arbitrary file read vulnerability in Storable Configs Plugin
Jenkins Storable Configs Plugin 1.0 and earlier allows users with Job/Read permission to read arbitrary files on the Jenkins controller.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-2277
https://www.jenkins.io/security/advisory/2020-09-16/#SEC…
[org.jvnet.hudson.plugins:selection-tasks-plugin] System command execution vulnerability in Selection tasks Jenkins Plugin
Jenkins Selection tasks Plugin 1.0 and earlier executes a user-specified program on the Jenkins controller, allowing attackers with Job/Configure permission to execute an arbitrary system command on the Jenkins controller as the OS user that the Jenkin…
[io.jenkins.plugins:perfecto] OS command execution vulnerability in Perfecto Plugin
Perfecto Plugin allows specifying Perfecto Connect Path and Perfecto Connect File Name in job configurations.
This command is executed on the Jenkins controller in Perfecto Plugin 1.17 and earlier, allowing attackers with Job/Configure permission to ru…
[io.jenkins.plugins:perfecto] Missing permission check in Perfecto Plugin
Perfecto Plugin 1.17 and earlier does not perform a permission check in a method implementing a connection test.
This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified username and passw…