Org.jenkins-ci.plugins CVEs with a working exploit
5 CVEs
Overview 5 matches · 0 protected · 0 exploited · 0 CISA KEV · 2 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
5
100.0%
No exploit published
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
5
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
5
100.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 2 / year
20131
Mitigation candidate1
Medium1
not blocked1
Working exploit published1
20140
20150
20160
20170
20181
Mitigation candidate1
High1
not blocked1
Working exploit published1
20192
Mitigation candidate2
High1
Medium1
not blocked2
Working exploit published2
20201
Mitigation candidate1
Medium1
not blocked1
Working exploit published1
20132014201520162017201820192020
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2020-2140 | Medium | 2020-03-09 | Mitigation candidate | Working exploit published | Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability. |
| CVE-2019-10475 | Medium | 2019-10-23 | Mitigation candidate | Working exploit published | A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin. |
| CVE-2019-1003005 | High | 2019-02-06 | Mitigation candidate | Working exploit published | A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM. |
| CVE-2018-8718 | High | 2018-03-27 | Mitigation candidate | Working exploit published | Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudson.tasks.Mailer/sendTestMail request. |
| CVE-2013-5676 | Medium | 2013-12-13 | Mitigation candidate | Working exploit published | The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure. |