CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2023-43495
https://notcve.org/view.php?id=CVE-2023-43495
Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNote', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control this parameter. Jenkins 2.423 y anteriores, LTS 2.414.1 y anteriores no escapan al valor del parámetro constructor 'caption' de 'ExpandableDetailsNote', lo que genera una vulnerabilidad de Store Cross-Site Scripting (XSS) que pueden explotar los atacantes capaces de controlar este parámetro. • http://www.openwall.com/lists/oss-security/2023/09/20/5 https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3245 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 1CVE-2023-43494
https://notcve.org/view.php?id=CVE-2023-43494
Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter values) from the search in the build history widget, allowing attackers with Item/Read permission to obtain values of sensitive variables used in builds by iteratively testing different characters until the correct sequence is discovered. Jenkins 2.50 a 2.423 (ambos inclusive), LTS 2.60.1 a 2.414.1 (ambos inclusive) no excluye variables de compilación confidenciales (por ejemplo, valores de parámetros de contraseña) de la búsqueda en el widget del historial de compilación, lo que permite a los atacantes con permiso de elemento/lectura. para obtener valores de variables sensibles utilizadas en compilaciones probando iterativamente diferentes caracteres hasta que se descubre la secuencia correcta. • https://github.com/mqxmm/CVE-2023-43494 http://www.openwall.com/lists/oss-security/2023/09/20/5 https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3261 •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41947
https://notcve.org/view.php?id=CVE-2023-41947
A missing permission check in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to Frugal Testing using attacker-specified credentials. Una comprobación de permisos faltante en el complemento Jenkins Frugal Testing 1.1 y versiones anteriores permite a los atacantes con permiso Overall/Read conectarse a Frugal Testing utilizando credenciales especificadas por el atacante. • http://www.openwall.com/lists/oss-security/2023/09/06/9 https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3082 • CWE-862: Missing Authorization •
CVSS: 3.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41946
https://notcve.org/view.php?id=CVE-2023-41946
A cross-site request forgery (CSRF) vulnerability in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers to connect to Frugal Testing using attacker-specified credentials, and to retrieve test IDs and names from Frugal Testing, if a valid credential corresponds to the attacker-specified username. Una vulnerabilidad de Cross-Site Request Forgery (CSRF) en el complemento Jenkins Frugal Testing 1.1 y versiones anteriores permite a los atacantes conectarse a Frugal Testing utilizando credenciales especificadas por el atacante y recuperar ID y nombres de prueba de Frugal Testing, si una credencial válida corresponde al nombre de usuario especificado por el atacante. • http://www.openwall.com/lists/oss-security/2023/09/06/9 https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3082 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41945
https://notcve.org/view.php?id=CVE-2023-41945
Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT permissions to be granted Overall/Manage and Overall/SystemRead permissions, even if those permissions are disabled and should not be granted. El complemento Jenkins Assembla Auth 1.14 y versiones anteriores no verifican que los permisos que concede estén habilitados, lo que hace que a los usuarios con permisos EDIT se les otorguen permisos Overall/Manage y Overall/SystemRead, incluso si esos permisos están deshabilitados y no deben concederse. • http://www.openwall.com/lists/oss-security/2023/09/06/9 https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3065 • CWE-862: Missing Authorization •