Read the docs

Jenkins

Records1915All Threatist records
Exploited (KEV)7In CISA KEV
CVSS critical79CVSS 9.0–10.0
CVSS high524CVSS 7.0–8.9

Exploited now

Jenkins records in CISA KEV
TI-2017-14573 Jenkins Remote Code Execution Vulnerability Priority CRITICAL 100KEV 2025-10-02TI-2024-15885 Jenkins Command Line Interface (CLI) Path Traversal Vulnerability Priority CRITICAL 100KEV 2024-08-19TI-2023-23979 HTTP/2 Rapid Reset Attack Vulnerability Priority CRITICAL 90KEV 2023-10-10TI-2015-04472 Jenkins User Interface (UI) Information Disclosure Vulnerability Priority CRITICAL 90KEV 2023-05-12TI-2019-15874 Jenkins Script Security Plugin Sandbox Bypass Vulnerability Priority CRITICAL 100KEV 2022-04-25TI-2019-15875 Jenkins Matrix Project Plugin Remote Code Execution Vulnerability Priority CRITICAL 100KEV 2022-03-25

Components

Products in the NVD configurations · select one to filter the records
Jenkins 294 records CRITICAL Script Security 45 records CRITICAL Pipeline 40 records CRITICAL Active Directory 12 records MEDIUM Blue Ocean 11 records MEDIUM Email Extension 11 records MEDIUM Git 11 records MEDIUM Build Failure Analyzer 9 records MEDIUM

Records

11 records in Blue Ocean · all components

TI-2023-21170 CVE-2023-40341 · GHSA-g4pq-p927-7pgg

Cross-site request forgery in Jenkins Blue Ocean Plugin

Priority MEDIUM 41

A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.27.5 and earlier allows attackers to connect to an attacker-specified URL, capturing GitHub credentials associated with an attacker-specifi…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00624 Published 2023-08-16 Partial fix · 1.27.5.1, 1.27.4.1 CWE-352
TI-2020-02131 CVE-2020-2254 · GHSA-vq7j-6pcq-f48p

Path traversal in Jenkins Blue Ocean Plugin

Priority LOW 33

Jenkins Blue Ocean Plugin 1.23.2 and earlier provides an undocumented feature flag that, when enabled, allows an attacker with Job/Configure or Job/Create permission to read arbitrary files on the Jenkins controller file…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02118 Published 2020-09-16 Fixed in 1.19.2, 1.23.3 CWE-22
TI-2022-13010 CVE-2022-30954 · GHSA-5m4q-x28v-q6wp

Missing authorization in Jenkins Blue Ocean Plugin

Priority LOW 31

Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP server.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00919 Published 2022-05-17 Partial fix · 1.25.0.1, 1.25.4 CWE-862
TI-2022-13008 CVE-2022-30952 · GHSA-g74w-93cp-5p3p

Insufficiently protected credentials in Jenkins Pipeline SCM API for Blue Ocean Plugin

Priority LOW 31

Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01024 Published 2022-05-17 Partial fix · 1.25.0.1, 1.25.4 CWE-522
TI-2019-15857 CVE-2019-1003012 · GHSA-qxh5-5r5p-5gvf

Cross-site request forgery in Jenkins Blue Ocean Plugins

Priority LOW 31

A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/js/fetch.ts, blueocean-core-js/src/js/i18n/i18n.js, blueocean-…

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.01108 Published 2019-02-06 Partial fix · 1.10.2 CWE-352
TI-2022-13009 CVE-2022-30953 · GHSA-hgpq-42pf-9vfq

Cross-site request forgery in Jenkins Blue Ocean Plugin

Priority LOW 30

A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00727 Published 2022-05-17 Partial fix · 1.25.0.1, 1.25.4 CWE-352
TI-2019-15858 CVE-2019-1003013 · GHSA-7fjr-5hph-c2mh

Cross-site scripting in Jenkins Blue Ocean Plugins

Priority LOW 27

An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java, blueocean-commons/src/main/java/io/jenkin…

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01227 Published 2019-02-06 Partial fix · 1.10.2 CWE-79
TI-2020-02132 CVE-2020-2255 · GHSA-vc7g-4269-f7hw

Missing authorization in Jenkins Blue Ocean Plugin

Priority LOW 22

A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00865 Published 2020-09-16 Fixed in 1.19.2, 1.23.3 CWE-862
Open these records in search →