Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

9 records

Vendor: Jenkins Component: Build Failure Analyzer Clear all filters
TI-2023-23259 CVE-2023-43502 · GHSA-2wwh-qgh8-w9xw

Cross-site request forgery in Jenkins Build Failure Analyzer Plugin

Priority LOW 20

A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to delete Failure Causes.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00388 Published 2023-09-20 Fixed in 2.4.2 CWE-352
TI-2023-23258 CVE-2023-43501 · GHSA-55q6-r3hm-7ff4

Missing authorization in Jenkins Build Failure Analyzer Plugin

Priority LOW 30

A missing permission check in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00609 Published 2023-09-20 Fixed in 2.4.2 CWE-862
TI-2023-23257 CVE-2023-43500 · GHSA-58rq-69jp-xc23

Cross-site request forgery in Jenkins Build Failure Analyzer Plugin

Priority MEDIUM 40

A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and pa…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00472 Published 2023-09-20 Fixed in 2.4.2 CWE-352
TI-2023-23256 CVE-2023-43499 · GHSA-262f-77q5-rqv6

Cross-site scripting in Jenkins Build Failure Analyzer Plugin

Priority LOW 25

Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or update…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00602 Published 2023-09-20 Fixed in 2.4.2 CWE-79
TI-2020-02121 CVE-2020-2244 · GHSA-p5jh-8rxp-wqjj

Cross-site scripting in Jenkins Build Failure Analyzer Plugin

Priority LOW 26

Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to provide conso…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00753 Published 2020-09-01 Fixed in 1.27.1 CWE-79
TI-2019-12417 CVE-2019-16555 · GHSA-2hhc-f86x-x74f

Uncontrolled resource consumption in Jenkins Build Failure Analyzer Plugin

Priority LOW 31

A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interruptible, allowing attackers to have Jenkins evaluate a regular expression without th…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01076 Published 2019-12-17 Fixed in 1.24.2 CWE-400
TI-2019-12416 CVE-2019-16554 · GHSA-x9gc-p2qp-4p7v

Incorrect default permissions in Jenkins Build Failure Analyzer Plugin

Priority LOW 22

A missing permission check in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers with Overall/Read permission to have Jenkins evaluate a computationally expensive regular expression.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00817 Published 2019-12-17 Fixed in 1.24.2 CWE-276
TI-2019-12415 CVE-2019-16553 · GHSA-543w-gq76-pw7g

Cross-site request forgery in Jenkins Build Failure Analyzer Plugin

Priority MEDIUM 40

A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins evaluate a computationally expensive regular expression.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00859 Published 2019-12-17 Fixed in 1.24.2 CWE-352