Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: Netflix Component: Chaos Monkey Clear all filters
TI-2020-02200 CVE-2020-2323 · GHSA-hx53-635r-vmv8

Missing authorization in Jenkins Chaos Monkey Plugin

Priority LOW 26

Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read permission to access the Chaos Monkey page and to see the history of actions.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00834 Published 2020-12-03 Fixed in 0.4.1 CWE-862
TI-2020-02199 CVE-2020-2322 · GHSA-mr75-899x-qcxq

Missing authorization in Jenkins Chaos Monkey Plugin

Priority LOW 36

Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to generate load and to generate memory leaks.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01339 Published 2020-12-03 Fixed in 0.4.1, 0.4 CWE-862