Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Advisory: Jenkins Job Configuration History Plugin — Jenkins Security Advisory 2023-09-06 Clear all filters
TI-2023-22318 CVE-2023-41933 · GHSA-ghjw-fcf6-rpr9

XML external entity injection in Jenkins Job Configuration History Plugin

Priority MEDIUM 42

Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00905 Published 2023-09-06 Fixed in 1229.v3039470161a_d CWE-611
TI-2023-22317 CVE-2023-41932 · GHSA-cgh7-rgqg-hrcx

XML external entity injection in Jenkins Job Configuration History Plugin

Priority LOW 30

Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackers with to delete attacker-specified directories on the Jenki…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0067 Published 2023-09-06 Fixed in 1229.v3039470161a_d CWE-611
TI-2023-22316 CVE-2023-41931 · GHSA-5jxp-f5rr-g6jc

Cross-site scripting in Jenkins Job Configuration History Plugin

Priority LOW 25

Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not property sanitize or escape the timestamp value from history entries when rendering a history entry on the history view, resulting in a st…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00499 Published 2023-09-06 Fixed in 1229.v3039470161a_d CWE-79
TI-2023-22315 CVE-2023-41930 · GHSA-c7r5-cww9-64q6

Path traversal in Jenkins Job Configuration History Plugin

Priority LOW 22

Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict the 'name' query parameter when rendering a history entry, allowing attackers to have Jenkins render a manipulated configuration…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00917 Published 2023-09-06 Fixed in 1229.v3039470161a_d CWE-22