admin/cvelist
1
0
Fork 0
mirror of https://github.com/CVEProject/cvelist.git synced 2025-06-07 21:47:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Jenkins 2019-03-25 security advisory

Browse Source
This commit is contained in:
Daniel Beck 2019-03-27 23:53:32 +01:00
parent bcf9bb34f1
commit 34effcf0f1
No known key found for this signature in database
GPG Key ID: 86E30187A0C5D16A
9 changed files with 531 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

59
2019/1003xxx/CVE-2019-1003040.json Normal file
View File

@ -0,0 +1,59 @@
{
"CVE_data_meta": {
"ID": "CVE-2019-1003040",
"ASSIGNER": "jenkinsci-cert@googlegroups.com"
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "Jenkins project",
"product": {
"product_data": [
{
"product_name": "Jenkins Script Security Plugin",
"version": {
"version_data": [
{
"version_value": "1.55 and earlier"
}
]
}
}
]
}
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-265"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1353"
}
]
}
}

59
2019/1003xxx/CVE-2019-1003041.json Normal file
View File

@ -0,0 +1,59 @@
{
"CVE_data_meta": {
"ID": "CVE-2019-1003041",
"ASSIGNER": "jenkinsci-cert@googlegroups.com"
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "Jenkins project",
"product": {
"product_data": [
{
"product_name": "Jenkins Pipeline: Groovy Plugin",
"version": {
"version_data": [
{
"version_value": "2.64 and earlier"
}
]
}
}
]
}
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-265"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1353"
}
]
}
}

59
2019/1003xxx/CVE-2019-1003042.json Normal file
View File

@ -0,0 +1,59 @@
{
"CVE_data_meta": {
"ID": "CVE-2019-1003042",
"ASSIGNER": "jenkinsci-cert@googlegroups.com"
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "Jenkins project",
"product": {
"product_data": [
{
"product_name": "Jenkins Lockable Resources Plugin",
"version": {
"version_data": [
{
"version_value": "2.4 and earlier"
}
]
}
}
]
}
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1361"
}
]
}
}

59
2019/1003xxx/CVE-2019-1003043.json Normal file
View File

@ -0,0 +1,59 @@
{
"CVE_data_meta": {
"ID": "CVE-2019-1003043",
"ASSIGNER": "jenkinsci-cert@googlegroups.com"
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "Jenkins project",
"product": {
"product_data": [
{
"product_name": "Jenkins Slack Notification Plugin",
"version": {
"version_data": [
{
"version_value": "2.19 and earlier"
}
]
}
}
]
}
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A missing permission check in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-285"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://jenkins.io/security/advisory/2019-03-25/#SECURITY-976"
}
]
}
}

59
2019/1003xxx/CVE-2019-1003044.json Normal file
View File

@ -0,0 +1,59 @@
{
"CVE_data_meta": {
"ID": "CVE-2019-1003044",
"ASSIGNER": "jenkinsci-cert@googlegroups.com"
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "Jenkins project",
"product": {
"product_data": [
{
"product_name": "Jenkins Slack Notification Plugin",
"version": {
"version_data": [
{
"version_value": "2.19 and earlier"
}
]
}
}
]
}
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A cross-site request forgery vulnerability in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-352"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://jenkins.io/security/advisory/2019-03-25/#SECURITY-976"
}
]
}
}

59
2019/1003xxx/CVE-2019-1003045.json Normal file
View File

@ -0,0 +1,59 @@
{
"CVE_data_meta": {
"ID": "CVE-2019-1003045",
"ASSIGNER": "jenkinsci-cert@googlegroups.com"
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "Jenkins project",
"product": {
"product_data": [
{
"product_name": "Jenkins ECS Publisher Plugin",
"version": {
"version_data": [
{
"version_value": "1.0.0 and earlier"
}
]
}
}
]
}
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in Jenkins ECS Publisher Plugin 1.0.0 and earlier allows attackers with Item/Extended Read permission, or local file system access to the Jenkins home directory to obtain the API token configured in this plugin's configuration."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-256"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://jenkins.io/security/advisory/2019-03-25/#SECURITY-846"
}
]
}
}

59
2019/1003xxx/CVE-2019-1003046.json Normal file
View File

@ -0,0 +1,59 @@
{
"CVE_data_meta": {
"ID": "CVE-2019-1003046",
"ASSIGNER": "jenkinsci-cert@googlegroups.com"
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "Jenkins project",
"product": {
"product_data": [
{
"product_name": "Jenkins Fortify on Demand Uploader Plugin",
"version": {
"version_data": [
{
"version_value": "3.0.10 and earlier"
}
]
}
}
]
}
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A cross-site request forgery vulnerability in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers to initiate a connection to an attacker-specified server."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-285"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://jenkins.io/security/advisory/2019-03-25/#SECURITY-992"
}
]
}
}

59
2019/1003xxx/CVE-2019-1003047.json Normal file
View File

@ -0,0 +1,59 @@
{
"CVE_data_meta": {
"ID": "CVE-2019-1003047",
"ASSIGNER": "jenkinsci-cert@googlegroups.com"
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "Jenkins project",
"product": {
"product_data": [
{
"product_name": "Jenkins Fortify on Demand Uploader Plugin",
"version": {
"version_data": [
{
"version_value": "3.0.10 and earlier"
}
]
}
}
]
}
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A missing permission check in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-352"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://jenkins.io/security/advisory/2019-03-25/#SECURITY-992"
}
]
}
}

59
2019/1003xxx/CVE-2019-1003048.json Normal file
View File

@ -0,0 +1,59 @@
{
"CVE_data_meta": {
"ID": "CVE-2019-1003048",
"ASSIGNER": "jenkinsci-cert@googlegroups.com"
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "Jenkins project",
"product": {
"product_data": [
{
"product_name": "Jenkins PRQA Plugin",
"version": {
"version_data": [
{
"version_value": "3.1.0 and earlier"
}
]
}
}
]
}
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in Jenkins PRQA Plugin 3.1.0 and earlier allows attackers with local file system access to the Jenkins home directory to obtain the unencrypted password from the plugin configuration."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-256"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1089"
}
]
}
}