Jenkins project Vulnerabilities and Affected Products
Vulnerabilities associated with Jenkins build-metrics Plugin.
Products
Clear product- Jenkins124 vulnerabilities
- Jenkins Script Security Plugin29 vulnerabilities
- Jenkins Active Directory Plugin11 vulnerabilities
- Jenkins Pipeline: Groovy Plugin11 vulnerabilities
- Jenkins Email Extension Plugin9 vulnerabilities
- Jenkins Build Failure Analyzer Plugin8 vulnerabilities
- Jenkins NS-ND Integration Performance Publisher Plugin8 vulnerabilities
- Jenkins OpenId Connect Authentication Plugin8 vulnerabilities
- Jenkins Pipeline: Shared Groovy Libraries Plugin8 vulnerabilities
- Jenkins Amazon EC2 Plugin7 vulnerabilities
- Jenkins Configuration as Code Plugin7 vulnerabilities
- Jenkins Git Plugin7 vulnerabilities
- Jenkins Job Configuration History Plugin7 vulnerabilities
- Jenkins OpenShift Deployer Plugin7 vulnerabilities
- Jenkins Rundeck Plugin7 vulnerabilities
- Jenkins SAML Single Sign On(SSO) Plugin7 vulnerabilities
- Jenkins Artifactory Plugin6 vulnerabilities
- Jenkins Azure VM Agents Plugin6 vulnerabilities
- Jenkins Config File Provider Plugin6 vulnerabilities
- Jenkins Credentials Binding Plugin6 vulnerabilities
- Jenkins Deployment Dashboard Plugin6 vulnerabilities
- Jenkins ElectricFlow Plugin6 vulnerabilities
- Jenkins Git Parameter Plugin6 vulnerabilities
- Jenkins GitLab Authentication Plugin6 vulnerabilities
- Jenkins GitLab Plugin6 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2022-34785MEDIUM | Jenkins build-metrics Plugin Missing Authorization vulnerabilityJenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about jobs otherwise inaccessible to them. | CVSS4.3v3.1 | EPSS0.649% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-34784MEDIUM | Cross site scripting in Jenkins build-metrics PluginJenkins build-metrics Plugin 1.3 does not escape the build description on one of its views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Build/Update permission. CWE-79Jun 30, 2022 | CVSS5.4v3.1 | EPSS0.715% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2019-10475MEDIUM | Jenkins build-metrics Plugin reflected cross-site scripting vulnerabilityA reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin. | CVSS6.1v3.1 | EPSS57.7% | PoCs2 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |