CVSS: 8.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41232
https://notcve.org/view.php?id=CVE-2022-41232
A cross-site request forgery (CSRF) vulnerability in Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers to replace any config.xml file on the Jenkins controller file system with an empty file by providing a crafted file name to an API endpoint. Una vulnerabilidad de tipo cross-site request forgery (CSRF) en Jenkins Build-Publisher Plugin versiones 1.22 y anteriores, permite a atacantes reemplazar cualquier archivo config.xml en el sistema de archivos del controlador Jenkins con un archivo vacío al proporcionar un nombre de archivo diseñado a un endpoint de la API • https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2139 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41230
https://notcve.org/view.php?id=CVE-2022-41230
Jenkins Build-Publisher Plugin 1.22 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obtain names and URLs of Jenkins servers that the plugin is configured to publish builds to, as well as builds pending for publication to those Jenkins servers. Jenkins Build-Publisher Plugin versiones 1.22 y anteriores, no lleva a cabo una comprobación de permisos en un endpoint HTTP, lo que permite a atacantes con permiso Overall/Read obtener los nombres y URLs de los servidores Jenkins en los que el plugin está configurado para publicar builds, así como los builds pendientes de publicar en esos servidores Jenkins • https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-1994 • CWE-862: Missing Authorization •
CVSS: 5.7EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41231
https://notcve.org/view.php?id=CVE-2022-41231
Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers with Item/Configure permission to create or replace any config.xml file on the Jenkins controller file system by providing a crafted file name to an API endpoint. Jenkins Build-Publisher Plugin versiones 1.22 y anteriores, permite a atacantes con permiso Item/Configure crear o reemplazar cualquier archivo config.xml en el sistema de archivos del controlador Jenkins proporcionando un nombre de archivo diseñado a un endpoint de la API • https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2139 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-1000387
https://notcve.org/view.php?id=CVE-2017-1000387
Jenkins Build-Publisher plugin version 1.21 and earlier stores credentials to other Jenkins instances in the file hudson.plugins.build_publisher.BuildPublisher.xml in the Jenkins master home directory. These credentials were stored unencrypted, allowing anyone with local file system access to access them. Additionally, the credentials were also transmitted in plain text as part of the configuration form. This could result in exposure of the credentials through browser extensions, cross-site scripting vulnerabilities, and similar situations. El plugin Jenkins Build-Publisher en su versión 1.21 y anteriores almacena credenciales en otras instancias de Jenkins en el archivo hudson.plugins.build_publisher.BuildPublisher.xml en el directorio de inicio del servidor maestro de Jenkins. • http://www.securityfocus.com/bid/101544 https://jenkins.io/security/advisory/2017-10-23 • CWE-522: Insufficiently Protected Credentials •