Jenkins
Jenkins Security Advisory 2020-03-09
2020-03-09 Mar 9, 2020 Source: Vendor
Imported by the Jenkins advisory catcher from https://www.jenkins.io/security/advisory/2020-03-09/. 23 SECURITY issues listed. Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.jenkins.io/security/advisory/2020-03-09/
Are you credited here?
Sign in and claim your line: it is yours immediately, no review queue.
The name the vendor printed stays next to your handle for anyone to check against the advisory above,
and any member who thinks a claim is wrong can refute it.
Credited
21 lines
Showing 1–21 of 21
CVE-2020-2144
BR2020-0000-015388
SECURITY-1702
unclaimed
XXE vulnerability in Rundeck Plugin
Credited as Cheng Gao, Alibaba Cloud Intelligence Security Team, https://www.aliyun.com/
CVE-2020-2139
BR2020-0000-015389
SECURITY-1668
unclaimed
Arbitrary file write vulnerability in Cobertura Plugin
Credited as Federico Pellegrin
CVE-2020-2138
BR2020-0000-015390
SECURITY-1700
unclaimed
XXE vulnerability in Cobertura Plugin
Credited as Federico Pellegrin
CVE-2020-2145
BR2020-0000-015391
SECURITY-1596
unclaimed
Credentials stored in plain text by Zephyr Enterprise Test Management Plugin
Credited as Ian Williams
CVE-2020-2153
BR2020-0000-015392
SECURITY-1510
unclaimed
Credentials transmitted in plain text by Backlog Plugin
Credited as James Holderness, IB Boost
CVE-2020-2156
BR2020-0000-015393
SECURITY-1511
unclaimed
Credentials transmitted in plain text by DeployHub Plugin
Credited as James Holderness, IB Boost
CVE-2020-2143
BR2020-0000-015394
SECURITY-1516
unclaimed
Credentials transmitted in plain text by Logstash Plugin
Credited as James Holderness, IB Boost
CVE-2020-2155
BR2020-0000-015395
SECURITY-1518
unclaimed
Credentials transmitted in plain text by OpenShift Deployer Plugin
Credited as James Holderness, IB Boost
CVE-2020-2151
BR2020-0000-015396
SECURITY-1519
unclaimed
Credentials transmitted in plain text by Quality Gates Plugin
Credited as James Holderness, IB Boost
CVE-2020-2149
BR2020-0000-015397
SECURITY-1520
unclaimed
Credentials transmitted in plain text by Repository Connector Plugin
Credited as James Holderness, IB Boost
CVE-2020-2157
BR2020-0000-015398
SECURITY-1522
unclaimed
Credentials transmitted in plain text by Skytap Cloud CI Plugin
Credited as James Holderness, IB Boost
CVE-2020-2150
BR2020-0000-015399
SECURITY-1523
unclaimed
Credentials transmitted in plain text by Sonar Quality Gates Plugin
Credited as James Holderness, IB Boost
CVE-2020-2154
BR2020-0000-015400
SECURITY-1550
unclaimed
Credentials stored in plain text by Zephyr for JIRA Test Management Plugin
Credited as James Holderness, IB Boost
CVE-2020-2134
BR2020-0000-015401
SECURITY-1754
unclaimed
Sandbox bypass vulnerability in Script Security Plugin
Credited as Nils Emmerich of ERNW Research GmbH
CVE-2020-2146
BR2020-0000-015402
SECURITY-1692
unclaimed
Missing SSH host key validation in Mac Plugin
Credited as Raihaan Shouhell, Autodesk, Inc
CVE-2020-2140
BR2020-0000-015403
SECURITY-1722
unclaimed
XSS vulnerability in Audit Trail Plugin
Credited as Wadeck Follonier, CloudBees, Inc.
CVE-2020-2136
BR2020-0000-015404
SECURITY-1723
unclaimed
Stored XSS vulnerability in Git Plugin
Credited as Wadeck Follonier, CloudBees, Inc.
CVE-2020-2152
BR2020-0000-015405
SECURITY-1727
unclaimed
XSS vulnerability in Subversion Release Manager Plugin
Credited as Wadeck Follonier, CloudBees, Inc.
CVE-2020-2147
BR2020-0000-015406
SECURITY-1761
unclaimed
CSRF vulnerability and missing permission checks in Mac Plugin
Credited as Wadeck Follonier, CloudBees, Inc.
CVE-2020-2141
BR2020-0000-015407
SECURITY-1765
unclaimed
CSRF vulnerability and missing permission checks in P4 Plugin
Credited as Wadeck Follonier, CloudBees, Inc.
CVE-2020-2137
BR2020-0000-015408
SECURITY-1784
unclaimed
Stored XSS vulnerability in Timestamper Plugin
Credited as Wadeck Follonier, CloudBees, Inc.