Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

11 records

Vendor: Jenkins Component: Blue Ocean Clear all filters
TI-2023-21170 CVE-2023-40341 · GHSA-g4pq-p927-7pgg

Cross-site request forgery in Jenkins Blue Ocean Plugin

Priority MEDIUM 41

A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.27.5 and earlier allows attackers to connect to an attacker-specified URL, capturing GitHub credentials associated with an attacker-specifi…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00624 Published 2023-08-16 Partial fix · 1.27.5.1, 1.27.4.1 CWE-352
TI-2022-13010 CVE-2022-30954 · GHSA-5m4q-x28v-q6wp

Missing authorization in Jenkins Blue Ocean Plugin

Priority LOW 31

Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP server.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00919 Published 2022-05-17 Partial fix · 1.25.0.1, 1.25.4 CWE-862
TI-2022-13009 CVE-2022-30953 · GHSA-hgpq-42pf-9vfq

Cross-site request forgery in Jenkins Blue Ocean Plugin

Priority LOW 30

A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00727 Published 2022-05-17 Partial fix · 1.25.0.1, 1.25.4 CWE-352
TI-2022-13008 CVE-2022-30952 · GHSA-g74w-93cp-5p3p

Insufficiently protected credentials in Jenkins Pipeline SCM API for Blue Ocean Plugin

Priority LOW 31

Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01024 Published 2022-05-17 Partial fix · 1.25.0.1, 1.25.4 CWE-522
TI-2020-02132 CVE-2020-2255 · GHSA-vc7g-4269-f7hw

Missing authorization in Jenkins Blue Ocean Plugin

Priority LOW 22

A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00865 Published 2020-09-16 Fixed in 1.19.2, 1.23.3 CWE-862
TI-2020-02131 CVE-2020-2254 · GHSA-vq7j-6pcq-f48p

Path traversal in Jenkins Blue Ocean Plugin

Priority LOW 33

Jenkins Blue Ocean Plugin 1.23.2 and earlier provides an undocumented feature flag that, when enabled, allows an attacker with Job/Configure or Job/Create permission to read arbitrary files on the Jenkins controller file…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02118 Published 2020-09-16 Fixed in 1.19.2, 1.23.3 CWE-22
TI-2019-15858 CVE-2019-1003013 · GHSA-7fjr-5hph-c2mh

Cross-site scripting in Jenkins Blue Ocean Plugins

Priority LOW 27

An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java, blueocean-commons/src/main/java/io/jenkin…

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01227 Published 2019-02-06 Partial fix · 1.10.2 CWE-79
TI-2019-15857 CVE-2019-1003012 · GHSA-qxh5-5r5p-5gvf

Cross-site request forgery in Jenkins Blue Ocean Plugins

Priority LOW 31

A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/js/fetch.ts, blueocean-core-js/src/js/i18n/i18n.js, blueocean-…

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.01108 Published 2019-02-06 Partial fix · 1.10.2 CWE-352