Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: Jenkins Publish Over SSH Plugin unspecified Clear all filters
TI-2022-07283 CVE-2022-23114 · GHSA-r3rr-wph6-9638

Insufficiently protected credentials in Jenkins Publish Over SSH Plugin

Priority LOW 16

Jenkins Publish Over SSH Plugin 1.22 and earlier stores password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00318 Published 2022-01-12 Fixed in 1.23 CWE-522
TI-2022-07282 CVE-2022-23113 · GHSA-j8rg-4hjm-8r95

Path traversal in Jenkins Publish Over SSH Plugin

Priority LOW 23

Jenkins Publish Over SSH Plugin 1.22 and earlier performs a validation of the file name specifying whether it is present or not, resulting in a path traversal vulnerability allowing attackers with Item/Configure permissi…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01554 Published 2022-01-12 Fixed in 1.23 CWE-22
TI-2022-07281 CVE-2022-23112 · GHSA-vc4r-j8j6-3fp6

Missing authorization in Jenkins Publish Over SSH Plugin

Priority LOW 31

A missing permission check in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers with Overall/Read access to connect to an attacker-specified SSH server using attacker-specified credentials.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00883 Published 2022-01-12 Fixed in 1.24 CWE-862
TI-2022-07280 CVE-2022-23111 · GHSA-884c-9wwh-9p6v

Cross-site request forgery in Jenkins Publish Over SSH Plugin

Priority MEDIUM 42

A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.26546 Published 2022-01-12 Fixed in 1.23 CWE-352
TI-2022-07279 CVE-2022-23110 · GHSA-fjpm-hf7c-xgc2

Cross-site scripting in Jenkins Publish Over SSH Plugin

Priority LOW 24

Jenkins Publish Over SSH Plugin 1.22 and earlier does not escape the SSH server name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00846 Published 2022-01-12 Fixed in 1.23 CWE-79