Read the docs

Jenkins

Records1915All Threatist records
Exploited (KEV)7In CISA KEV
CVSS critical79CVSS 9.0–10.0
CVSS high524CVSS 7.0–8.9

Exploited now

Jenkins records in CISA KEV
TI-2017-14573 Jenkins Remote Code Execution Vulnerability Priority CRITICAL 100KEV 2025-10-02TI-2024-15885 Jenkins Command Line Interface (CLI) Path Traversal Vulnerability Priority CRITICAL 100KEV 2024-08-19TI-2023-23979 HTTP/2 Rapid Reset Attack Vulnerability Priority CRITICAL 90KEV 2023-10-10TI-2015-04472 Jenkins User Interface (UI) Information Disclosure Vulnerability Priority CRITICAL 90KEV 2023-05-12TI-2019-15874 Jenkins Script Security Plugin Sandbox Bypass Vulnerability Priority CRITICAL 100KEV 2022-04-25TI-2019-15875 Jenkins Matrix Project Plugin Remote Code Execution Vulnerability Priority CRITICAL 100KEV 2022-03-25

Components

Products in the NVD configurations · select one to filter the records
Jenkins 294 records CRITICAL Script Security 45 records CRITICAL Pipeline 40 records CRITICAL Active Directory 12 records MEDIUM Blue Ocean 11 records MEDIUM Email Extension 11 records MEDIUM Git 11 records MEDIUM Build Failure Analyzer 9 records MEDIUM

Records

9 records in Build Failure Analyzer · all components

TI-2023-23257 CVE-2023-43500 · GHSA-58rq-69jp-xc23

Cross-site request forgery in Jenkins Build Failure Analyzer Plugin

Priority MEDIUM 40

A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and pa…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00472 Published 2023-09-20 Fixed in 2.4.2 CWE-352
TI-2019-12415 CVE-2019-16553 · GHSA-543w-gq76-pw7g

Cross-site request forgery in Jenkins Build Failure Analyzer Plugin

Priority MEDIUM 40

A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins evaluate a computationally expensive regular expression.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00859 Published 2019-12-17 Fixed in 1.24.2 CWE-352
TI-2019-12417 CVE-2019-16555 · GHSA-2hhc-f86x-x74f

Uncontrolled resource consumption in Jenkins Build Failure Analyzer Plugin

Priority LOW 31

A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interruptible, allowing attackers to have Jenkins evaluate a regular expression without th…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01076 Published 2019-12-17 Fixed in 1.24.2 CWE-400
TI-2023-23258 CVE-2023-43501 · GHSA-55q6-r3hm-7ff4

Missing authorization in Jenkins Build Failure Analyzer Plugin

Priority LOW 30

A missing permission check in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00609 Published 2023-09-20 Fixed in 2.4.2 CWE-862
TI-2020-02121 CVE-2020-2244 · GHSA-p5jh-8rxp-wqjj

Cross-site scripting in Jenkins Build Failure Analyzer Plugin

Priority LOW 26

Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to provide conso…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00753 Published 2020-09-01 Fixed in 1.27.1 CWE-79
TI-2023-23256 CVE-2023-43499 · GHSA-262f-77q5-rqv6

Cross-site scripting in Jenkins Build Failure Analyzer Plugin

Priority LOW 25

Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or update…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00602 Published 2023-09-20 Fixed in 2.4.2 CWE-79
TI-2019-12416 CVE-2019-16554 · GHSA-x9gc-p2qp-4p7v

Incorrect default permissions in Jenkins Build Failure Analyzer Plugin

Priority LOW 22

A missing permission check in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers with Overall/Read permission to have Jenkins evaluate a computationally expensive regular expression.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00817 Published 2019-12-17 Fixed in 1.24.2 CWE-276
TI-2023-23259 CVE-2023-43502 · GHSA-2wwh-qgh8-w9xw

Cross-site request forgery in Jenkins Build Failure Analyzer Plugin

Priority LOW 20

A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to delete Failure Causes.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00388 Published 2023-09-20 Fixed in 2.4.2 CWE-352
Open these records in search →