Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Advisory: Jenkins Nexus Platform Plugin — Jenkins Security Advisory 2023-12-13 Clear all filters
TI-2023-27699 CVE-2023-50769 · GHSA-4g5f-w3mh-w99m

Missing authorization in Jenkins Nexus Platform Plugin

Priority LOW 21

Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtai…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00485 Published 2023-12-13 Fixed in 3.18.1-01 CWE-862
TI-2023-27698 CVE-2023-50768 · GHSA-phjq-7xqp-2526

Cross-site request forgery in Jenkins Nexus Platform Plugin

Priority MEDIUM 40

A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00447 Published 2023-12-13 Fixed in 3.18.1-01 CWE-352
TI-2023-27697 CVE-2023-50767 · GHSA-9vrm-747r-668v

Missing authorization in Jenkins Nexus Platform Plugin

Priority LOW 25

Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.0044 Published 2023-12-13 Fixed in 3.18.1-01 CWE-862
TI-2023-27696 CVE-2023-50766 · GHSA-4gfc-72gw-v385

Cross-site request forgery in Jenkins Nexus Platform Plugin

Priority MEDIUM 40

A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00447 Published 2023-12-13 Fixed in 3.18.1-01 CWE-352