CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-46688
https://notcve.org/view.php?id=CVE-2022-46688
A cross-site request forgery (CSRF) vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have Jenkins connect to Gerrit servers (previously configured by Jenkins administrators) using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkins. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en el complemento Jenkins Sonar Gerrit 377.v8f3808963dc5 y versiones anteriores permite a los atacantes hacer que Jenkins se conecte a los servidores Gerrit (previamente configurados por los administradores de Jenkins) utilizando ID de credenciales especificadas por el atacante obtenidas a través de otro método, capturando potencialmente las credenciales. almacenado en Jenkins. • https://www.jenkins.io/security/advisory/2022-12-07/#SECURITY-1002 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-46684
https://notcve.org/view.php?id=CVE-2022-46684
Jenkins Checkmarx Plugin 2022.3.3 and earlier does not escape values returned from the Checkmarx service API before inserting them into HTML reports, resulting in a stored cross-site scripting (XSS) vulnerability. Jenkins Checkmarx Plugin 2022.3.3 y versiones anteriores no escapa a los valores devueltos por la API del servicio Checkmarx antes de insertarlos en informes HTML, lo que genera una vulnerabilidad de Cross-Site Scripting (XSS) Almacenado. • https://www.jenkins.io/security/advisory/2022-12-07/#SECURITY-2869 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-46687
https://notcve.org/view.php?id=CVE-2022-46687
Jenkins Spring Config Plugin 2.0.0 and earlier does not escape build display names shown on the Spring Config view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to change build display names. Jenkins Spring Config Plugin 2.0.0 y versiones anteriores no escapan a los nombres para mostrar de las compilaciones que se muestran en la vista Spring Config, lo que genera una vulnerabilidad de Cross-Site Scripting (XSS) Almacenado que pueden explotar los atacantes capaces de cambiar los nombres para mostrar de las compilaciones. • https://www.jenkins.io/security/advisory/2022-12-07/#SECURITY-2814 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-45381 – jenkins-plugin/pipeline-utility-steps: Arbitrary file read vulnerability in Pipeline Utility Steps Plugin
https://notcve.org/view.php?id=CVE-2022-45381
Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of Apache Commons Configuration library that enable the 'file:' prefix interpolator by default, allowing attackers able to configure Pipelines to read arbitrary files from the Jenkins controller file system. Jenkins Pipeline Utility Steps Plugin 2.13.1 y versiones anteriores no restringe el conjunto de interpoladores de prefijos habilitados y las versiones de paquetes de la librería de configuración Apache Commons que habilitan el interpolador de prefijos 'file:' de forma predeterminada, lo que permite a los atacantes capaces de configurar Pipelines para leer archivos arbitrarios de el sistema de archivos del controlador Jenkins. A flaw was found in the Pipeline Utility Steps Jenkins Plugin. The affected version of the Pipeline Utility Steps Plugin does not restrict the set of enabled prefix interpolators and bundles versions of this library that enable the file: prefix interpolator by default. This flaw allows attackers who can configure Pipelines to read arbitrary files from the Jenkins controller file system. • http://www.openwall.com/lists/oss-security/2022/11/15/4 https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2949 https://access.redhat.com/security/cve/CVE-2022-45381 https://bugzilla.redhat.com/show_bug.cgi?id=2143089 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-45383
https://notcve.org/view.php?id=CVE-2022-45383
An incorrect permission check in Jenkins Support Core Plugin 1206.v14049fa_b_d860 and earlier allows attackers with Support/DownloadBundle permission to download a previously created support bundle containing information limited to users with Overall/Administer permission. Una verificación de permisos incorrecta en Jenkins Support Core Plugin 1206.v14049fa_b_d860 y versiones anteriores permite a atacantes con permiso Support/DownloadBundle descargar un paquete de soporte creado previamente que contiene información limitada a usuarios con permiso General/Administrador. • http://www.openwall.com/lists/oss-security/2022/11/15/4 https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2804 • CWE-863: Incorrect Authorization •