Jenkins
Jenkins Security Advisory 2023-05-16
2023-05-16 May 16, 2023 Source: Vendor
Imported by the Jenkins advisory catcher from https://www.jenkins.io/security/advisory/2023-05-16/. 22 SECURITY issues listed. Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.jenkins.io/security/advisory/2023-05-16/
Are you credited here?
Sign in and claim your line: it is yours immediately, no review queue.
The name the vendor printed stays next to your handle for anyone to check against the advisory above,
and any member who thinks a claim is wrong can refute it.
Credited
24 lines
Showing 1–24 of 24 matching · clear filters
CVE-2023-2195
BR2023-0000-009907
SECURITY-3118
unclaimed
CSRF vulnerability and missing permission checks in Code Dx Plugin
Credited as Alvaro Muñoz (@pwntester), GitHub Security Lab
CVE-2023-32998
BR2023-0000-009908
SECURITY-3121
unclaimed
CSRF vulnerability and missing permission check in AppSpider Plugin
Credited as Alvaro Muñoz (@pwntester), GitHub Security Lab
CVE-2023-33000
BR2023-0000-009909
SECURITY-2962
unclaimed
Credentials displayed without masking by NS-ND Integration Performance Publisher Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2023-33006
BR2023-0000-009910
SECURITY-2990
unclaimed
CSRF vulnerability in wso2id-oauth Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-33005
BR2023-0000-009911
SECURITY-2991
unclaimed
Session fixation vulnerability in wso2id-oauth Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-32995
BR2023-0000-009912
SECURITY-2994
unclaimed
CSRF vulnerability and missing permission check in SAML Single Sign On(SSO) Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-32997
BR2023-0000-009913
SECURITY-3000
unclaimed
Session fixation vulnerability in CAS Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-32982
BR2023-0000-009914
SECURITY-3017
unclaimed
Secrets stored and displayed in plain text by Ansible Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-32977
BR2023-0000-009915
SECURITY-3042
unclaimed
Stored XSS vulnerability in Pipeline: Job Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-32978
BR2023-0000-009916
SECURITY-3046
unclaimed
CSRF vulnerability in LDAP Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-2196
BR2023-0000-009917
SECURITY-3145
unclaimed
Missing permission checks in Code Dx Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-32987
BR2023-0000-009918
SECURITY-3002
unclaimed
CSRF vulnerability in Reverse Proxy Auth Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-32987
BR2023-0000-009919
SECURITY-3002
unclaimed
CSRF vulnerability in Reverse Proxy Auth Plugin
Credited as Yaroslav Afenkin, CloudBees, Inc.
CVE-2023-32991
BR2023-0000-009920
SECURITY-2993
unclaimed
CSRF vulnerability and missing permission checks in SAML Single Sign On(SSO) Plugin allow XXE
Credited as Kevin Guerroudj, CloudBees, Inc. and, independently, Alvaro Muñoz (@pwntester), GitHub Security Lab
CVE-2023-32986
BR2023-0000-009921
SECURITY-3123
unclaimed
Arbitrary file write vulnerability in File Parameter Plugin
Credited as Tony Torralba (@atorralba), GitHub Security Lab
CVE-2023-32985
BR2023-0000-009922
SECURITY-3125
unclaimed
Path traversal vulnerability in Sidebar Link Plugin
Credited as Tony Torralba (@atorralba), GitHub Security Lab
CVE-2023-32981
BR2023-0000-009923
SECURITY-2196
unclaimed
Arbitrary file write vulnerability on agents in Pipeline Utility Steps Plugin
Credited as Trung Pham, and, independently, Tony Torralba (@atorralba), GitHub Security Lab
CVE-2023-32984
BR2023-0000-009924
SECURITY-3047
unclaimed
Stored XSS vulnerability in TestNG Results Plugin
Credited as Valdes Che Zogou
Acknowledgement
BR2023-0000-009925
SECURITY-2855
unclaimed
SECURITY-2855
Credited as Valdes Che Zogou, CloudBees, Inc.
CVE-2023-33002
BR2023-0000-009926
SECURITY-2892
unclaimed
Stored XSS vulnerability in TestComplete support Plugin
Credited as Valdes Che Zogou, CloudBees, Inc.
CVE-2023-33007
BR2023-0000-009927
SECURITY-2903
unclaimed
Stored XSS vulnerability in LoadComplete support Plugin
Credited as Yaroslav Afenkin, CloudBees, Inc.
Acknowledgement
BR2023-0000-009928
SECURITY-3001
unclaimed
SECURITY-3001
Credited as Yaroslav Afenkin, CloudBees, Inc.
CVE-2023-33003
BR2023-0000-009929
SECURITY-3083
unclaimed
CSRF vulnerability and missing permission checks in Tag Profiler Plugin
Credited as Yaroslav Afenkin, CloudBees, Inc.
CVE-2023-2632
BR2023-0000-009930
SECURITY-3146
unclaimed
API keys stored and displayed in plain text by Code Dx Plugin
Credited as Yaroslav Afenkin, CloudBees, Inc.