Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Advisory: Jenkins PaaSLane Estimate Plugin — Jenkins Security Advisory 2023-12-13 Clear all filters
TI-2023-27709 CVE-2023-50779 · GHSA-jqr2-7f24-xrgc

Missing authorization in Jenkins PaaSLane Estimate Plugin

Priority LOW 21

Missing permission checks in Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified token.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00479 Published 2023-12-13 No fix listed CWE-862
TI-2023-27708 CVE-2023-50778 · GHSA-g4xm-5mqm-8m32

Cross-site request forgery in Jenkins PaaSLane Estimate Plugin

Priority LOW 38

A cross-site request forgery (CSRF) vulnerability in Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified URL using an attacker-specified token.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00414 Published 2023-12-13 No fix listed CWE-352
TI-2023-27707 CVE-2023-50777 · GHSA-v9w3-34xq-hrjg

Incorrect authorization in Jenkins PaaSLane Estimate Plugin

Priority LOW 20

Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier does not mask PaaSLane authentication tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00318 Published 2023-12-13 No fix listed CWE-863
TI-2023-27706 CVE-2023-50776 · GHSA-c2f6-rf2r-6j6f

Cleartext storage of sensitive information in Jenkins PaaSLane Estimate Plugin

Priority LOW 20

Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier stores PaaSLane authentication tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00339 Published 2023-12-13 No fix listed CWE-312