Vulnerabilities

TI-2024-27474 CVE-2024-41122 · GHSA-3wf2-2pq4-4rvc

Custom environment variables allow to alter execution flow of plugins in Woodpecker

MEDIUM 41

Woodpecker is a simple yet powerful CI/CD engine with great extensibility.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00618 Published 2024-07-19 Fixed in 2.7.0 CWE-74

TI-2024-27473 CVE-2024-41121 · GHSA-xw35-rrcp-g7xm

MEDIUM 41

Woodpecker is a simple yet powerful CI/CD engine with great extensibility.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00737 Published 2024-07-19 Fixed in 2.7.0 CWE-74

TI-2023-20924 CVE-2023-40034 · GHSA-4gcf-5m39-98mc

LOW 39

Woodpecker is a community fork of the Drone CI system.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00883 Published 2023-08-16 Fixed in 1.0.2 CWE-20

TI-2022-12293 CVE-2022-29947 · GHSA-vmp5-c5hp-6c65

LOW 28

Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00677 Published 2022-04-29 Fixed in 0.15.1 CWE-79