Maven Package Vulnerabilities
Vulnerabilities associated with org.jenkins-ci.plugins:build-metrics.
Packages
Clear package- org.jenkins-ci.main:jenkins-core257 vulnerabilities
- org.apache.tomcat:tomcat160 vulnerabilities
- com.liferay.portal:release.portal.bom159 vulnerabilities
- com.liferay.portal:release.dxp.bom125 vulnerabilities
- org.keycloak:keycloak-services97 vulnerabilities
- com.fasterxml.jackson.core:jackson-databind80 vulnerabilities
- org.apache.tomcat.embed:tomcat-embed-core74 vulnerabilities
- org.apache.struts:struts2-core60 vulnerabilities
- org.keycloak:keycloak-core50 vulnerabilities
- org.xwiki.platform:xwiki-platform-oldcore46 vulnerabilities
- org.elasticsearch:elasticsearch44 vulnerabilities
- net.mingsoft:ms-mcms39 vulnerabilities
- org.apache.tomcat:tomcat-catalina39 vulnerabilities
- io.undertow:undertow-core38 vulnerabilities
- com.thoughtworks.xstream:xstream37 vulnerabilities
- com.jfinal:jfinal36 vulnerabilities
- org.jenkins-ci.plugins:script-security35 vulnerabilities
- org.apache.solr:solr-core31 vulnerabilities
- org.apache.tomcat:tomcat-coyote31 vulnerabilities
- org.opencms:opencms-core31 vulnerabilities
- org.springframework.security:spring-security-core31 vulnerabilities
- org.eclipse.jetty:jetty-server29 vulnerabilities
- org.bouncycastle:bcprov-jdk1426 vulnerabilities
- org.apache.openmeetings:openmeetings-parent25 vulnerabilities
- org.keycloak:keycloak-parent25 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2022-34785MEDIUM | Jenkins build-metrics Plugin Missing Authorization vulnerabilityJenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about jobs otherwise inaccessible to them. | CVSS4.3v3.1 | EPSS0.649% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-34784MEDIUM | Cross site scripting in Jenkins build-metrics PluginJenkins build-metrics Plugin 1.3 does not escape the build description on one of its views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Build/Update permission. CWE-79Jun 30, 2022 | CVSS5.4v3.1 | EPSS0.715% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2019-10475MEDIUM | Jenkins build-metrics Plugin reflected cross-site scripting vulnerabilityA reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin. | CVSS6.1v3.1 | EPSS57.7% | PoCs2 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |