Jenkins
Jenkins Security Advisory 2023-03-21
2023-03-21 Mar 21, 2023 Source: Vendor
Imported by the Jenkins advisory catcher from https://www.jenkins.io/security/advisory/2023-03-21/. 13 SECURITY issues listed. Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.jenkins.io/security/advisory/2023-03-21/
Are you credited here?
Sign in and claim your line: it is yours immediately, no review queue.
The name the vendor printed stays next to your handle for anyone to check against the advisory above,
and any member who thinks a claim is wrong can refute it.
Credited
17 lines
Showing 1–17 of 17
CVE-2023-28680
BR2023-0000-009990
SECURITY-2925
unclaimed
XXE vulnerability in Crap4J Plugin
Credited as CC Bomber, Kitri BoB
CVE-2023-28681
BR2023-0000-009991
SECURITY-2926
unclaimed
XXE vulnerability in Visual Studio Code Metrics Plugin
Credited as CC Bomber, Kitri BoB
CVE-2023-28682
BR2023-0000-009992
SECURITY-2928
unclaimed
XXE vulnerability in Performance Publisher Plugin
Credited as CC Bomber, Kitri BoB
CVE-2023-28685
BR2023-0000-009993
SECURITY-2930
unclaimed
XXE vulnerability in AbsInt a³ Plugin
Credited as CC Bomber, Kitri BoB
CVE-2023-28683
BR2023-0000-009994
SECURITY-2942
unclaimed
XXE vulnerability in Phabricator Differential Plugin
Credited as CC Bomber, Kitri BoB
CVE-2023-28676
BR2023-0000-009995
SECURITY-2963
unclaimed
CSRF vulnerability in Convert To Pipeline Plugin results in RCE
Credited as CC Bomber, Kitri BoB
CVE-2023-28678
BR2023-0000-009996
SECURITY-2809
unclaimed
Stored XSS vulnerability in Cppcheck Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2023-28678
BR2023-0000-009997
SECURITY-2809
unclaimed
Stored XSS vulnerability in Cppcheck Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-28668
BR2023-0000-009998
SECURITY-3053
unclaimed
Incorrect permission checks in Role-based Authorization Strategy Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2023-28668
BR2023-0000-009999
SECURITY-3053
unclaimed
Incorrect permission checks in Role-based Authorization Strategy Plugin
Credited as Yaroslav Afenkin, CloudBees, Inc.
CVE-2023-28670
BR2023-0000-010000
SECURITY-2885
unclaimed
Stored XSS vulnerability in Pipeline Aggregator View Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-28669
BR2023-0000-010001
SECURITY-3061
unclaimed
Stored XSS vulnerability in JaCoCo Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-28684
BR2023-0000-010002
SECURITY-2956
unclaimed
XXE vulnerability in remote-jobs-view-plugin Plugin
Credited as LaNyer640
CVE-2023-28684
BR2023-0000-010003
SECURITY-2956
unclaimed
XXE vulnerability in remote-jobs-view-plugin Plugin
Credited as Crilwa
CVE-2023-28679
BR2023-0000-010004
SECURITY-2813
unclaimed
Stored XSS vulnerability in Mashup Portlets Plugin
Credited as Valdes Che Zogou, CloudBees, Inc.
CVE-2023-28677
BR2023-0000-010005
SECURITY-2966
unclaimed
Command injection vulnerability in Convert To Pipeline Plugin results in RCE
Credited as Yaroslav Afenkin, CloudBees, Inc.
Acknowledgement
BR2023-0000-010006
SECURITY-3067
unclaimed
SECURITY-3067
Credited as Yaroslav Afenkin, CloudBees, Inc.