All the vulnerabilites related to Jenkins project - Jenkins WebSphere Deployer Plugin
cve-2019-1003056
Vulnerability from cvelistv5
Published
2019-04-04 15:38
Modified
2024-08-05 03:07
Severity ?
EPSS score ?
Summary
Jenkins WebSphere Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
References
▼ | URL | Tags |
---|---|---|
http://www.securityfocus.com/bid/107790 | vdb-entry, x_refsource_BID | |
http://www.openwall.com/lists/oss-security/2019/04/12/2 | mailing-list, x_refsource_MLIST | |
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-956 | x_refsource_CONFIRM |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
▼ | Jenkins project | Jenkins WebSphere Deployer Plugin |
Version: all versions as of 2019-04-03 |
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T03:07:17.883Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "107790", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/107790" }, { "name": "[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2019/04/12/2" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://jenkins.io/security/advisory/2019-04-03/#SECURITY-956" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Jenkins WebSphere Deployer Plugin", "vendor": "Jenkins project", "versions": [ { "status": "affected", "version": "all versions as of 2019-04-03" } ] } ], "descriptions": [ { "lang": "en", "value": "Jenkins WebSphere Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system." } ], "providerMetadata": { "dateUpdated": "2023-10-24T16:45:36.263Z", "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins" }, "references": [ { "name": "107790", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/107790" }, { "name": "[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://www.openwall.com/lists/oss-security/2019/04/12/2" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://jenkins.io/security/advisory/2019-04-03/#SECURITY-956" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "jenkinsci-cert@googlegroups.com", "ID": "CVE-2019-1003056", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Jenkins WebSphere Deployer Plugin", "version": { "version_data": [ { "version_value": "all versions as of 2019-04-03" } ] } } ] }, "vendor_name": "Jenkins project" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Jenkins WebSphere Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-256" } ] } ] }, "references": { "reference_data": [ { "name": "107790", "refsource": "BID", "url": "http://www.securityfocus.com/bid/107790" }, { "name": "[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2019/04/12/2" }, { "name": "https://jenkins.io/security/advisory/2019-04-03/#SECURITY-956", "refsource": "CONFIRM", "url": "https://jenkins.io/security/advisory/2019-04-03/#SECURITY-956" } ] } } } }, "cveMetadata": { "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "assignerShortName": "jenkins", "cveId": "CVE-2019-1003056", "datePublished": "2019-04-04T15:38:48", "dateReserved": "2019-04-03T00:00:00", "dateUpdated": "2024-08-05T03:07:17.883Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2019-16559
Vulnerability from cvelistv5
Published
2019-12-17 14:40
Modified
2024-08-05 01:17
Severity ?
EPSS score ?
Summary
A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read permission to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system.
References
▼ | URL | Tags |
---|---|---|
https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1371 | x_refsource_CONFIRM | |
http://www.openwall.com/lists/oss-security/2019/12/17/1 | mailing-list, x_refsource_MLIST |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
▼ | Jenkins project | Jenkins WebSphere Deployer Plugin |
Version: unspecified < |
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T01:17:40.812Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1371" }, { "name": "[oss-security] 20191217 Multiple vulnerabilities in Jenkins plugins", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2019/12/17/1" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Jenkins WebSphere Deployer Plugin", "vendor": "Jenkins project", "versions": [ { "lessThanOrEqual": "1.6.1", "status": "affected", "version": "unspecified", "versionType": "custom" }, { "lessThan": "unspecified", "status": "unknown", "version": "next of 1.6.1", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read permission to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system." } ], "providerMetadata": { "dateUpdated": "2023-10-24T16:50:50.355Z", "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins" }, "references": [ { "tags": [ "x_refsource_CONFIRM" ], "url": "https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1371" }, { "name": "[oss-security] 20191217 Multiple vulnerabilities in Jenkins plugins", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://www.openwall.com/lists/oss-security/2019/12/17/1" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "jenkinsci-cert@googlegroups.com", "ID": "CVE-2019-16559", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Jenkins WebSphere Deployer Plugin", "version": { "version_data": [ { "version_affected": "\u003c=", "version_value": "1.6.1" }, { "version_affected": "?\u003e", "version_value": "1.6.1" } ] } } ] }, "vendor_name": "Jenkins project" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read permission to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-285: Improper Authorization" } ] } ] }, "references": { "reference_data": [ { "name": "https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1371", "refsource": "CONFIRM", "url": "https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1371" }, { "name": "[oss-security] 20191217 Multiple vulnerabilities in Jenkins plugins", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2019/12/17/1" } ] } } } }, "cveMetadata": { "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "assignerShortName": "jenkins", "cveId": "CVE-2019-16559", "datePublished": "2019-12-17T14:40:49", "dateReserved": "2019-09-20T00:00:00", "dateUpdated": "2024-08-05T01:17:40.812Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2020-2108
Vulnerability from cvelistv5
Published
2020-01-29 15:15
Modified
2024-08-04 07:01
Severity ?
EPSS score ?
Summary
Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XXE attacks which can be exploited by a user with Job/Configure permissions.
References
▼ | URL | Tags |
---|---|---|
https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1719 | x_refsource_CONFIRM | |
http://www.openwall.com/lists/oss-security/2020/01/29/1 | mailing-list, x_refsource_MLIST |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
▼ | Jenkins project | Jenkins WebSphere Deployer Plugin |
Version: unspecified < |
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T07:01:39.769Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1719" }, { "name": "[oss-security] 20200129 Multiple vulnerabilities in Jenkins and Jenkins plugins", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2020/01/29/1" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Jenkins WebSphere Deployer Plugin", "vendor": "Jenkins project", "versions": [ { "lessThanOrEqual": "1.6.1", "status": "affected", "version": "unspecified", "versionType": "custom" }, { "lessThan": "unspecified", "status": "unknown", "version": "next of 1.6.1", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XXE attacks which can be exploited by a user with Job/Configure permissions." } ], "providerMetadata": { "dateUpdated": "2023-10-24T16:05:03.624Z", "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins" }, "references": [ { "tags": [ "x_refsource_CONFIRM" ], "url": "https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1719" }, { "name": "[oss-security] 20200129 Multiple vulnerabilities in Jenkins and Jenkins plugins", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://www.openwall.com/lists/oss-security/2020/01/29/1" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "jenkinsci-cert@googlegroups.com", "ID": "CVE-2020-2108", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Jenkins WebSphere Deployer Plugin", "version": { "version_data": [ { "version_affected": "\u003c=", "version_value": "1.6.1" }, { "version_affected": "?\u003e", "version_value": "1.6.1" } ] } } ] }, "vendor_name": "Jenkins project" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XXE attacks which can be exploited by a user with Job/Configure permissions." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-611: Improper Restriction of XML External Entity Reference" } ] } ] }, "references": { "reference_data": [ { "name": "https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1719", "refsource": "CONFIRM", "url": "https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1719" }, { "name": "[oss-security] 20200129 Multiple vulnerabilities in Jenkins and Jenkins plugins", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2020/01/29/1" } ] } } } }, "cveMetadata": { "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "assignerShortName": "jenkins", "cveId": "CVE-2020-2108", "datePublished": "2020-01-29T15:15:31", "dateReserved": "2019-12-05T00:00:00", "dateUpdated": "2024-08-04T07:01:39.769Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2019-16561
Vulnerability from cvelistv5
Published
2019-12-17 14:40
Modified
2024-08-05 01:17
Severity ?
EPSS score ?
Summary
Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire Jenkins master JVM.
References
▼ | URL | Tags |
---|---|---|
https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1581 | x_refsource_CONFIRM | |
http://www.openwall.com/lists/oss-security/2019/12/17/1 | mailing-list, x_refsource_MLIST |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
▼ | Jenkins project | Jenkins WebSphere Deployer Plugin |
Version: unspecified < |
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T01:17:41.047Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1581" }, { "name": "[oss-security] 20191217 Multiple vulnerabilities in Jenkins plugins", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2019/12/17/1" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Jenkins WebSphere Deployer Plugin", "vendor": "Jenkins project", "versions": [ { "lessThanOrEqual": "1.6.1", "status": "affected", "version": "unspecified", "versionType": "custom" }, { "lessThan": "unspecified", "status": "unknown", "version": "next of 1.6.1", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire Jenkins master JVM." } ], "providerMetadata": { "dateUpdated": "2023-10-24T16:50:52.630Z", "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins" }, "references": [ { "tags": [ "x_refsource_CONFIRM" ], "url": "https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1581" }, { "name": "[oss-security] 20191217 Multiple vulnerabilities in Jenkins plugins", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://www.openwall.com/lists/oss-security/2019/12/17/1" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "jenkinsci-cert@googlegroups.com", "ID": "CVE-2019-16561", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Jenkins WebSphere Deployer Plugin", "version": { "version_data": [ { "version_affected": "\u003c=", "version_value": "1.6.1" }, { "version_affected": "?\u003e", "version_value": "1.6.1" } ] } } ] }, "vendor_name": "Jenkins project" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire Jenkins master JVM." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-295: Improper Certificate Validation" } ] } ] }, "references": { "reference_data": [ { "name": "https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1581", "refsource": "CONFIRM", "url": "https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1581" }, { "name": "[oss-security] 20191217 Multiple vulnerabilities in Jenkins plugins", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2019/12/17/1" } ] } } } }, "cveMetadata": { "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "assignerShortName": "jenkins", "cveId": "CVE-2019-16561", "datePublished": "2019-12-17T14:40:50", "dateReserved": "2019-09-20T00:00:00", "dateUpdated": "2024-08-05T01:17:41.047Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2019-16560
Vulnerability from cvelistv5
Published
2019-12-17 14:40
Modified
2024-08-05 01:17
Severity ?
EPSS score ?
Summary
A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system.
References
▼ | URL | Tags |
---|---|---|
https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1371 | x_refsource_CONFIRM | |
http://www.openwall.com/lists/oss-security/2019/12/17/1 | mailing-list, x_refsource_MLIST |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
▼ | Jenkins project | Jenkins WebSphere Deployer Plugin |
Version: unspecified < |
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T01:17:41.041Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1371" }, { "name": "[oss-security] 20191217 Multiple vulnerabilities in Jenkins plugins", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2019/12/17/1" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Jenkins WebSphere Deployer Plugin", "vendor": "Jenkins project", "versions": [ { "lessThanOrEqual": "1.6.1", "status": "affected", "version": "unspecified", "versionType": "custom" }, { "lessThan": "unspecified", "status": "unknown", "version": "next of 1.6.1", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system." } ], "providerMetadata": { "dateUpdated": "2023-10-24T16:50:51.502Z", "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins" }, "references": [ { "tags": [ "x_refsource_CONFIRM" ], "url": "https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1371" }, { "name": "[oss-security] 20191217 Multiple vulnerabilities in Jenkins plugins", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://www.openwall.com/lists/oss-security/2019/12/17/1" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "jenkinsci-cert@googlegroups.com", "ID": "CVE-2019-16560", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Jenkins WebSphere Deployer Plugin", "version": { "version_data": [ { "version_affected": "\u003c=", "version_value": "1.6.1" }, { "version_affected": "?\u003e", "version_value": "1.6.1" } ] } } ] }, "vendor_name": "Jenkins project" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-352: Cross-Site Request Forgery (CSRF)" } ] } ] }, "references": { "reference_data": [ { "name": "https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1371", "refsource": "CONFIRM", "url": "https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1371" }, { "name": "[oss-security] 20191217 Multiple vulnerabilities in Jenkins plugins", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2019/12/17/1" } ] } } } }, "cveMetadata": { "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "assignerShortName": "jenkins", "cveId": "CVE-2019-16560", "datePublished": "2019-12-17T14:40:50", "dateReserved": "2019-09-20T00:00:00", "dateUpdated": "2024-08-05T01:17:41.041Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }