Jenkins
Jenkins Security Advisory 2020-03-25
2020-03-25 Mar 25, 2020 Source: Vendor
Imported by the Jenkins advisory catcher from https://www.jenkins.io/security/advisory/2020-03-25/. 10 SECURITY issues listed. Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.jenkins.io/security/advisory/2020-03-25/
Are you credited here?
Sign in and claim your line: it is yours immediately, no review queue.
The name the vendor printed stays next to your handle for anyone to check against the advisory above,
and any member who thinks a claim is wrong can refute it.
Credited
9 lines
Showing 1–9 of 9
CVE-2020-2170
BR2020-0000-015379
SECURITY-1676
unclaimed
Stored XSS vulnerability in RapidDeploy Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2020-2171
BR2020-0000-015380
SECURITY-1677
unclaimed
XXE vulnerability in RapidDeploy Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2020-2168
BR2020-0000-015381
SECURITY-1732
unclaimed
RCE vulnerability in Azure Container Service Plugin
Credited as Daniel Kalinowski of ISEC.pl Research Team
Acknowledgement
BR2020-0000-015382
SECURITY-1542
unclaimed
SECURITY-1542
Credited as James Holderness, IB Boost
Acknowledgement
BR2020-0000-015383
SECURITY-1542
unclaimed
SECURITY-1542
Credited as ethorsa
CVE-2020-2160
BR2020-0000-015384
SECURITY-1774
unclaimed
CSRF protection for any URL could be bypassed
Credited as Nick Collisson from Gemini Trust Company, LLC.
CVE-2020-2162
BR2020-0000-015385
SECURITY-1793
unclaimed
Stored XSS vulnerability in file parameters
Credited as Phu X. Mai, University of Luxembourg
CVE-2020-2169
BR2020-0000-015386
SECURITY-1724
unclaimed
Reflected XSS vulnerability in Queue cleanup Plugin
Credited as Wadeck Follonier, CloudBees, Inc.
CVE-2020-2161
BR2020-0000-015387
SECURITY-1781
unclaimed
Stored XSS vulnerability in label expression validation
Credited as Wadeck Follonier, CloudBees, Inc.