Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

11 records

Vendor: Jenkins Component: Git Clear all filters
TI-2022-18196 CVE-2022-38663 · GHSA-jxmw-3gxf-fprh

Insufficiently protected credentials in Jenkins Git Plugin

Priority LOW 31

Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the Git Username and Password (`gitUsernamePassword`) credentials binding.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00939 Published 2022-08-23 Partial fix · 4.9.4, 4.11.5 CWE-522
TI-2022-17099 CVE-2022-36884 · GHSA-449w-c77c-vmf6

Missing authentication in Jenkins Git Plugin

Priority LOW 26

The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an attacker-specified Git repository.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01089 Published 2022-07-27 Partial fix · 4.9.3, 4.11.4 CWE-306
TI-2022-17098 CVE-2022-36883 · GHSA-v878-67xw-grw2

Missing authorization in Jenkins Git Plugin

Priority MEDIUM 43

A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an atta…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.07005 Published 2022-07-27 Partial fix · 4.9.3, 4.11.4 CWE-862
TI-2022-17097 CVE-2022-36882 · GHSA-8xwj-2wgh-gprh

Cross-site request forgery in Jenkins Git Plugin

Priority LOW 39

A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0074 Published 2022-07-27 Partial fix · 4.9.3, 4.11.4 CWE-352
TI-2022-13003 CVE-2022-30947 · GHSA-84cm-vjwm-m979

Path traversal in Jenkins Git Plugin

Priority LOW 35

Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited inform…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01304 Published 2022-05-17 Fixed in 4.9.1, 4.11.2 +2 CWE-22
TI-2021-04764 CVE-2021-21684 · GHSA-gghc-g8cj-4vfv

Improper output encoding in Jenkins Git Plugin

Priority LOW 30

Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerabilit…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01242 Published 2021-10-06 Partial fix · 4.7.1.1, 4.3.1 +1 CWE-116
TI-2020-02013 CVE-2020-2136 · GHSA-6c7r-6p5m-cp82

Cross-site scripting in Jenkins Git Plugin

Priority LOW 26

Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation, resulting in a stored cross-site scripting vulnerability.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00853 Published 2020-03-09 Fixed in 4.2.1 CWE-79
TI-2019-15855 CVE-2019-1003010 · GHSA-r8rw-xx57-m64q

A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier…

Priority LOW 22

A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.java that allows attackers to create a Git tag in a workspace and attach correspo…

CVSS 3.0MEDIUM 4.3 Network No auth User interaction EPSS 0.01145 Published 2019-02-06 Partial fix · 3.9.2 CWE-352
TI-2018-15831 CVE-2018-1000182 · GHSA-53wf-vqf9-cgf2

A server-side request forgery vulnerability exists in Jenkins Git Plugin 3.9.0 and older…

Priority LOW 30

A server-side request forgery vulnerability exists in Jenkins Git Plugin 3.9.0 and older in AssemblaWeb.java, GitBlitRepositoryBrowser.java, Gitiles.java, TFS2013GitRepositoryBrowser.java, ViewGitWeb.java that allows att…

CVSS 3.0MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00809 Published 2018-06-05 Partial fix · 3.9.1 CWE-918