Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Jenkins Chef Sinatra Plugin unspecified Clear all filters
TI-2022-08922 CVE-2022-25209 · GHSA-38w8-h222-wrpp

XML external entity injection in Jenkins Chef Sinatra Plugin

Priority MEDIUM 40

Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01107 Published 2022-02-15 No fix listed CWE-611
TI-2022-08921 CVE-2022-25208 · GHSA-fq56-c7rj-j3j9

Missing authorization in Jenkins Chef Sinatra Plugin

Priority MEDIUM 40

A missing permission check in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers with Overall/Read permission to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML respons…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01097 Published 2022-02-15 No fix listed CWE-862
TI-2022-08920 CVE-2022-25207 · GHSA-x92v-xv3x-9v29

Cross-site request forgery in Jenkins Chef Sinatra Plugin

Priority LOW 39

A cross-site request forgery (CSRF) vulnerability in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML response.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00717 Published 2022-02-15 No fix listed CWE-352