Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Advisory: Jenkins AWS CodeCommit Trigger Plugin — Jenkins Security Advisory 2023-09-06 Clear all filters
TI-2023-22329 CVE-2023-41944 · GHSA-g4qf-5523-7wvf

Cross-site scripting in Jenkins AWS CodeCommit Trigger Plugin

Priority LOW 28

Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter passed to a form validation URL, when rendering an error message, resulting in an HTML injection vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00498 Published 2023-09-06 No fix listed CWE-79
TI-2023-22328 CVE-2023-41943 · GHSA-r428-g373-m2h4

Missing authorization in Jenkins AWS CodeCommit Trigger Plugin

Priority LOW 30

Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to clear the SQS queue.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00643 Published 2023-09-06 No fix listed CWE-862
TI-2023-22327 CVE-2023-41942 · GHSA-997j-37h7-mhg9

Cross-site request forgery in Jenkins AWS CodeCommit Trigger Plugin

Priority LOW 20

A cross-site request forgery (CSRF) vulnerability in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers to clear the SQS queue.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00328 Published 2023-09-06 No fix listed CWE-352
TI-2023-22326 CVE-2023-41941 · GHSA-pfg6-cj3j-rpv4

Missing authorization in Jenkins AWS CodeCommit Trigger Plugin

Priority LOW 20

A missing permission check in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00448 Published 2023-09-06 No fix listed CWE-862