Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: Jenkins unspecified Clear all filters
TI-2022-15090 CVE-2022-34175 · GHSA-p3rc-946h-8cf5

Protection mechanism failure in Jenkins

Priority LOW 36

Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing some view fragments containing sensitive information, bypassing any permission chec…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01397 Published 2022-06-22 Fixed in 2.356 CWE-693
TI-2022-15088 CVE-2022-34173 · GHSA-6g4r-q7qg-6qx6

Cross-site scripting in Jenkins

Priority LOW 27

In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in a cross-site scripting (XSS) vulnerability exploitable by at…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01473 Published 2022-06-22 Fixed in 2.356 CWE-79
TI-2022-15087 CVE-2022-34172 · GHSA-mhp7-3393-pfqr

Cross-site scripting in Jenkins

Priority LOW 27

In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site scripting (XSS) vulnerability.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01473 Published 2022-06-22 Fixed in 2.356, 2.332.4 CWE-79
TI-2022-15086 CVE-2022-34171 · GHSA-7f84-p6r5-jr6q

Cross-site scripting in Jenkins

Priority LOW 28

In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' (until Jenkins 2…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01557 Published 2022-06-22 Fixed in 2.356, 2.346.1 +1 CWE-79
TI-2022-15085 CVE-2022-34170 · GHSA-62wf-24c4-8r76

Cross-site scripting in Jenkins

Priority LOW 28

In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-19…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01564 Published 2022-06-22 Fixed in 2.356, 2.332.4 +1 CWE-79