WaratekVRT Sign in

Medium Jenkins SSH CVEs

10 CVEs, 1 protected by Waratek

Reset
More filters (2)
Columns
Vendor jenkins✕Product ssh✕
Overview 10 matches · 1 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
10matches 1protected10.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 10.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 9 90.0%
Critical 0 0.0% High 0 0.0% Medium 10 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 10.0% partly blocked 0 0.0% not blocked 9 90.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 10 100.0%
split by peak 5 / quarter
No exploit published: 9Protected by Waratek: 1 Medium: 10 not blocked: 9blocked by ARMR today: 1 No public exploit: 10
Q2 181 No exploit published1 Medium1 not blocked1 No public exploit1 Q3 182 No exploit published2 Medium2 not blocked2 No public exploit2 Q4 180 Q1 190 Q2 190 Q3 190 Q4 190 Q1 200 Q2 200 Q3 200 Q4 200 Q1 210 Q2 210 Q3 210 Q4 210 Q1 225 Protected by Waratek1 No exploit published4 Medium5 blocked by ARMR today1 not blocked4 No public exploit5 Q2 222 No exploit published2 Medium2 not blocked2 No public exploit2
Q2 18Q4 18Q2 19Q4 19Q2 20Q4 20Q2 21Q4 21Q2 22
10 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-30959 Medium 2022-05-17 No exploit published No public exploit A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2022-30957 Medium 2022-05-17 No exploit published No public exploit A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2022-23113 Medium 2022-01-12 Protected by Waratek No public exploit Jenkins Publish Over SSH Plugin 1.22 and earlier performs a validation of the file name specifying whether it is present or not, resulting in a path traversal vulnerability allowing attackers with Item/Configure permission to discover the name of the Jenkins controller files.
CVE-2022-23112 Medium 2022-01-12 No exploit published No public exploit A missing permission check in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers with Overall/Read access to connect to an attacker-specified SSH server using attacker-specified credentials.
CVE-2022-23111 Medium 2022-01-12 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials.
CVE-2022-23110 Medium 2022-01-12 No exploit published No public exploit Jenkins Publish Over SSH Plugin 1.22 and earlier does not escape the SSH server name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.
CVE-2022-20620 Medium 2022-01-12 No exploit published No public exploit Missing permission checks in Jenkins SSH Agent Plugin 1.23 and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2018-1999036 Medium 2018-08-01 No exploit published No public exploit An exposure of sensitive information vulnerability exists in Jenkins SSH Agent Plugin 1.15 and earlier in SSHAgentStepExecution.java that exposes the SSH private key password to users with permission to read the build log.
CVE-2017-2648 Medium 2018-07-27 No exploit published No public exploit It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling Man-in-the-Middle attacks.
CVE-2018-1000601 Medium 2018-06-26 No exploit published No public exploit A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attackers with a Jenkins account and the permission to configure credential bindings to read arbitrary files from the Jenkins master file system.