jenkins / git CVEs · Mitigation candidate

VRT Sign in

Look up CVE IDs Status Exploitation Severity

Reset

Overview 3 matches · 0 protected · 0 CISA KEV · 2 EPSS ≥ 0.5

3matches 0protected0.0% 0CISA KEV0.0% 2EPSS ≥ 0.566.7%

Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 3 100.0% No exploit published 0 0.0%

Critical 0 0.0% High 2 66.7% Medium 1 33.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 3 100.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 3 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%

split by StatusSeverityProtectionExploit maturity peak 1 / quarter

Q2 181 Mitigation candidate1 High1 not blocked1 Exploited1 Q3 180 Q4 180 Q1 190 Q2 190 Q3 190 Q4 190 Q1 201 Mitigation candidate1 Medium1 not blocked1 Exploited1 Q2 200 Q3 200 Q4 200 Q1 210 Q2 210 Q3 210 Q4 210 Q1 220 Q2 220 Q3 221 Mitigation candidate1 High1 not blocked1 Exploited1

Q3 18Q1 19Q3 19Q1 20Q3 20Q1 21Q3 21Q1 22Q3 22

3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2022-36883	High	2022-07-27	Mitigation candidate	Exploited	A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.
CVE-2020-2096	Medium	2020-01-15	Mitigation candidate	Exploited	Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability.
CVE-2018-1000600	High	2018-06-26	Mitigation candidate	Exploited	A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java that allows attackers to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2022-36883

High

2022-07-27

Mitigation candidate

Exploited

A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.

CVE-2020-2096

Medium

2020-01-15

Mitigation candidate

Exploited

Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability.

CVE-2018-1000600

High

2018-06-26

Mitigation candidate

Exploited

A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java that allows attackers to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.