diff --git a/2020/2xxx/CVE-2020-2252.json b/2020/2xxx/CVE-2020-2252.json index 944106d69c5..e739a8e639e 100644 --- a/2020/2xxx/CVE-2020-2252.json +++ b/2020/2xxx/CVE-2020-2252.json @@ -1,17 +1,69 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-2252", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "jenkinsci-cert@googlegroups.com" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Jenkins project", + "product": { + "product_data": [ + { + "product_name": "Jenkins Mailer Plugin", + "version": { + "version_data": [ + { + "version_value": "1.32", + "version_affected": "<=" + }, + { + "version_value": "1.29.1", + "version_affected": "!" + }, + { + "version_value": "1.31.1", + "version_affected": "!" + } + ] + } + } + ] + } + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Jenkins Mailer Plugin 1.32 and earlier does not perform hostname validation when connecting to the configured SMTP server." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-297: Improper Validation of Certificate with Host Mismatch" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1813", + "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1813", + "refsource": "CONFIRM" } ] } diff --git a/2020/2xxx/CVE-2020-2253.json b/2020/2xxx/CVE-2020-2253.json index ef8c1f333ef..4933effc0fa 100644 --- a/2020/2xxx/CVE-2020-2253.json +++ b/2020/2xxx/CVE-2020-2253.json @@ -1,17 +1,69 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-2253", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "jenkinsci-cert@googlegroups.com" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Jenkins project", + "product": { + "product_data": [ + { + "product_name": "Jenkins Email Extension Plugin", + "version": { + "version_data": [ + { + "version_value": "2.75", + "version_affected": "<=" + }, + { + "version_value": "2.69.1", + "version_affected": "!" + }, + { + "version_value": "2.68.1", + "version_affected": "!" + } + ] + } + } + ] + } + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-297: Improper Validation of Certificate with Host Mismatch" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1851", + "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1851", + "refsource": "CONFIRM" } ] } diff --git a/2020/2xxx/CVE-2020-2254.json b/2020/2xxx/CVE-2020-2254.json index e247de1aa0a..bcc0340fc99 100644 --- a/2020/2xxx/CVE-2020-2254.json +++ b/2020/2xxx/CVE-2020-2254.json @@ -1,17 +1,65 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-2254", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "jenkinsci-cert@googlegroups.com" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Jenkins project", + "product": { + "product_data": [ + { + "product_name": "Jenkins Blue Ocean Plugin", + "version": { + "version_data": [ + { + "version_value": "1.23.2", + "version_affected": "<=" + }, + { + "version_value": "1.19.2", + "version_affected": "!" + } + ] + } + } + ] + } + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Jenkins Blue Ocean Plugin 1.23.2 and earlier provides an undocumented feature flag that, when enabled, allows an attacker with Job/Configure or Job/Create permission to read arbitrary files on the Jenkins controller file system." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1956", + "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1956", + "refsource": "CONFIRM" } ] } diff --git a/2020/2xxx/CVE-2020-2255.json b/2020/2xxx/CVE-2020-2255.json index c991d39dc0a..639a203249b 100644 --- a/2020/2xxx/CVE-2020-2255.json +++ b/2020/2xxx/CVE-2020-2255.json @@ -1,17 +1,65 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-2255", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "jenkinsci-cert@googlegroups.com" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Jenkins project", + "product": { + "product_data": [ + { + "product_name": "Jenkins Blue Ocean Plugin", + "version": { + "version_data": [ + { + "version_value": "1.23.2", + "version_affected": "<=" + }, + { + "version_value": "1.19.2", + "version_affected": "!" + } + ] + } + } + ] + } + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-918: Server-Side Request Forgery (SSRF)" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1961", + "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1961", + "refsource": "CONFIRM" } ] } diff --git a/2020/2xxx/CVE-2020-2256.json b/2020/2xxx/CVE-2020-2256.json index 3360d99c64a..a804fdb02d2 100644 --- a/2020/2xxx/CVE-2020-2256.json +++ b/2020/2xxx/CVE-2020-2256.json @@ -1,17 +1,61 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-2256", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "jenkinsci-cert@googlegroups.com" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Jenkins project", + "product": { + "product_data": [ + { + "product_name": "Jenkins Pipeline Maven Integration Plugin", + "version": { + "version_data": [ + { + "version_value": "3.9.2", + "version_affected": "<=" + } + ] + } + } + ] + } + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Jenkins Pipeline Maven Integration Plugin 3.9.2 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1976", + "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1976", + "refsource": "CONFIRM" } ] } diff --git a/2020/2xxx/CVE-2020-2257.json b/2020/2xxx/CVE-2020-2257.json index 8fa44d64305..cbf1d51af81 100644 --- a/2020/2xxx/CVE-2020-2257.json +++ b/2020/2xxx/CVE-2020-2257.json @@ -1,17 +1,61 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-2257", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "jenkinsci-cert@googlegroups.com" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Jenkins project", + "product": { + "product_data": [ + { + "product_name": "Jenkins Validating String Parameter Plugin", + "version": { + "version_data": [ + { + "version_value": "2.4", + "version_affected": "<=" + } + ] + } + } + ] + } + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Jenkins Validating String Parameter Plugin 2.4 and earlier does not escape various user-controlled fields, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1935", + "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1935", + "refsource": "CONFIRM" } ] } diff --git a/2020/2xxx/CVE-2020-2258.json b/2020/2xxx/CVE-2020-2258.json index 36b1df62e8d..fa74678809b 100644 --- a/2020/2xxx/CVE-2020-2258.json +++ b/2020/2xxx/CVE-2020-2258.json @@ -1,17 +1,69 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-2258", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "jenkinsci-cert@googlegroups.com" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Jenkins project", + "product": { + "product_data": [ + { + "product_name": "Jenkins Health Advisor by CloudBees Plugin", + "version": { + "version_data": [ + { + "version_value": "3.2.0", + "version_affected": "<=" + }, + { + "version_value": "3.1.1", + "version_affected": "!" + }, + { + "version_value": "3.0.2", + "version_affected": "!" + } + ] + } + } + ] + } + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Jenkins Health Advisor by CloudBees Plugin 3.2.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to view that HTTP endpoint." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-863: Incorrect Authorization" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1998", + "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1998", + "refsource": "CONFIRM" } ] } diff --git a/2020/2xxx/CVE-2020-2259.json b/2020/2xxx/CVE-2020-2259.json index 265350642a1..8df5fd0c28f 100644 --- a/2020/2xxx/CVE-2020-2259.json +++ b/2020/2xxx/CVE-2020-2259.json @@ -1,17 +1,61 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-2259", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "jenkinsci-cert@googlegroups.com" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Jenkins project", + "product": { + "product_data": [ + { + "product_name": "Jenkins computer-queue-plugin Plugin", + "version": { + "version_data": [ + { + "version_value": "1.5", + "version_affected": "<=" + } + ] + } + } + ] + } + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Jenkins computer-queue-plugin Plugin 1.5 and earlier does not escape the agent name in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1912", + "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1912", + "refsource": "CONFIRM" } ] } diff --git a/2020/2xxx/CVE-2020-2260.json b/2020/2xxx/CVE-2020-2260.json index b506ad510e0..73bf0448158 100644 --- a/2020/2xxx/CVE-2020-2260.json +++ b/2020/2xxx/CVE-2020-2260.json @@ -1,17 +1,61 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-2260", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "jenkinsci-cert@googlegroups.com" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Jenkins project", + "product": { + "product_data": [ + { + "product_name": "Jenkins Perfecto Plugin", + "version": { + "version_data": [ + { + "version_value": "1.17", + "version_affected": "<=" + } + ] + } + } + ] + } + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A missing permission check in Jenkins Perfecto Plugin 1.17 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-862: Missing Authorization" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1979", + "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1979", + "refsource": "CONFIRM" } ] } diff --git a/2020/2xxx/CVE-2020-2261.json b/2020/2xxx/CVE-2020-2261.json index 2aab713f8b0..6632c220512 100644 --- a/2020/2xxx/CVE-2020-2261.json +++ b/2020/2xxx/CVE-2020-2261.json @@ -1,17 +1,61 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-2261", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "jenkinsci-cert@googlegroups.com" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Jenkins project", + "product": { + "product_data": [ + { + "product_name": "Jenkins Perfecto Plugin", + "version": { + "version_data": [ + { + "version_value": "1.17", + "version_affected": "<=" + } + ] + } + } + ] + } + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Jenkins Perfecto Plugin 1.17 and earlier executes a command on the Jenkins controller, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controller" + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1980", + "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1980", + "refsource": "CONFIRM" } ] } diff --git a/2020/2xxx/CVE-2020-2262.json b/2020/2xxx/CVE-2020-2262.json index e37c53f372a..2e87f7552b0 100644 --- a/2020/2xxx/CVE-2020-2262.json +++ b/2020/2xxx/CVE-2020-2262.json @@ -1,17 +1,65 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-2262", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "jenkinsci-cert@googlegroups.com" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Jenkins project", + "product": { + "product_data": [ + { + "product_name": "Jenkins Android Lint Plugin", + "version": { + "version_data": [ + { + "version_value": "2.6", + "version_affected": "<=" + }, + { + "version_value": "2.6", + "version_affected": "?>" + } + ] + } + } + ] + } + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Jenkins Android Lint Plugin 2.6 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide report files to the plugin's post-build step." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1908", + "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1908", + "refsource": "CONFIRM" } ] } diff --git a/2020/2xxx/CVE-2020-2263.json b/2020/2xxx/CVE-2020-2263.json index f4e34d160f1..b67b5694ab9 100644 --- a/2020/2xxx/CVE-2020-2263.json +++ b/2020/2xxx/CVE-2020-2263.json @@ -1,17 +1,65 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-2263", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "jenkinsci-cert@googlegroups.com" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Jenkins project", + "product": { + "product_data": [ + { + "product_name": "Jenkins Radiator View Plugin", + "version": { + "version_data": [ + { + "version_value": "1.29", + "version_affected": "<=" + }, + { + "version_value": "1.29", + "version_affected": "?>" + } + ] + } + } + ] + } + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Jenkins Radiator View Plugin 1.29 and earlier does not escape the full name of the jobs in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1927", + "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1927", + "refsource": "CONFIRM" } ] } diff --git a/2020/2xxx/CVE-2020-2264.json b/2020/2xxx/CVE-2020-2264.json index 9c64c109ad7..0c866a22410 100644 --- a/2020/2xxx/CVE-2020-2264.json +++ b/2020/2xxx/CVE-2020-2264.json @@ -1,17 +1,65 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-2264", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "jenkinsci-cert@googlegroups.com" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Jenkins project", + "product": { + "product_data": [ + { + "product_name": "Jenkins Custom Job Icon Plugin", + "version": { + "version_data": [ + { + "version_value": "0.2", + "version_affected": "<=" + }, + { + "version_value": "0.2", + "version_affected": "?>" + } + ] + } + } + ] + } + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Jenkins Custom Job Icon Plugin 0.2 and earlier does not escape the job descriptions in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1914", + "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1914", + "refsource": "CONFIRM" } ] } diff --git a/2020/2xxx/CVE-2020-2265.json b/2020/2xxx/CVE-2020-2265.json index 42dd67e5bd9..680625e449c 100644 --- a/2020/2xxx/CVE-2020-2265.json +++ b/2020/2xxx/CVE-2020-2265.json @@ -1,17 +1,65 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-2265", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "jenkinsci-cert@googlegroups.com" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Jenkins project", + "product": { + "product_data": [ + { + "product_name": "Jenkins Coverage/Complexity Scatter Plot Plugin", + "version": { + "version_data": [ + { + "version_value": "1.1.1", + "version_affected": "<=" + }, + { + "version_value": "1.1.1", + "version_affected": "?>" + } + ] + } + } + ] + } + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not escape the method information in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide report files to the plugin's post-build step." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1913", + "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1913", + "refsource": "CONFIRM" } ] } diff --git a/2020/2xxx/CVE-2020-2266.json b/2020/2xxx/CVE-2020-2266.json index a820fb6e58b..f0ff8f42d51 100644 --- a/2020/2xxx/CVE-2020-2266.json +++ b/2020/2xxx/CVE-2020-2266.json @@ -1,17 +1,65 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-2266", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "jenkinsci-cert@googlegroups.com" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Jenkins project", + "product": { + "product_data": [ + { + "product_name": "Jenkins Description Column Plugin", + "version": { + "version_data": [ + { + "version_value": "1.3", + "version_affected": "<=" + }, + { + "version_value": "1.3", + "version_affected": "?>" + } + ] + } + } + ] + } + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Jenkins Description Column Plugin 1.3 and earlier does not escape the job description in the column tooltip, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1916", + "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1916", + "refsource": "CONFIRM" } ] } diff --git a/2020/2xxx/CVE-2020-2267.json b/2020/2xxx/CVE-2020-2267.json index 5b9318a358e..219da13f00d 100644 --- a/2020/2xxx/CVE-2020-2267.json +++ b/2020/2xxx/CVE-2020-2267.json @@ -1,17 +1,65 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-2267", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "jenkinsci-cert@googlegroups.com" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Jenkins project", + "product": { + "product_data": [ + { + "product_name": "Jenkins MongoDB Plugin", + "version": { + "version_data": [ + { + "version_value": "1.3", + "version_affected": "<=" + }, + { + "version_value": "1.3", + "version_affected": "?>" + } + ] + } + } + ] + } + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A missing permission check in Jenkins MongoDB Plugin 1.3 and earlier allows attackers with Overall/Read permission to gain access to some metadata of any arbitrary files on the Jenkins controller." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-862: Missing Authorization" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1904", + "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1904", + "refsource": "CONFIRM" } ] } diff --git a/2020/2xxx/CVE-2020-2268.json b/2020/2xxx/CVE-2020-2268.json index 24b2b6ff651..4c19f247965 100644 --- a/2020/2xxx/CVE-2020-2268.json +++ b/2020/2xxx/CVE-2020-2268.json @@ -1,17 +1,65 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-2268", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "jenkinsci-cert@googlegroups.com" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Jenkins project", + "product": { + "product_data": [ + { + "product_name": "Jenkins MongoDB Plugin", + "version": { + "version_data": [ + { + "version_value": "1.3", + "version_affected": "<=" + }, + { + "version_value": "1.3", + "version_affected": "?>" + } + ] + } + } + ] + } + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins MongoDB Plugin 1.3 and earlier allows attackers to gain access to some metadata of any arbitrary files on the Jenkins controller." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-352: Cross-Site Request Forgery (CSRF)" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1904", + "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1904", + "refsource": "CONFIRM" } ] } diff --git a/2020/2xxx/CVE-2020-2269.json b/2020/2xxx/CVE-2020-2269.json index 196ce55de2f..cefcced8d7a 100644 --- a/2020/2xxx/CVE-2020-2269.json +++ b/2020/2xxx/CVE-2020-2269.json @@ -1,17 +1,65 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-2269", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "jenkinsci-cert@googlegroups.com" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Jenkins project", + "product": { + "product_data": [ + { + "product_name": "Jenkins chosen-views-tabbar Plugin", + "version": { + "version_data": [ + { + "version_value": "1.2", + "version_affected": "<=" + }, + { + "version_value": "1.2", + "version_affected": "?>" + } + ] + } + } + ] + } + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Jenkins chosen-views-tabbar Plugin 1.2 and earlier does not escape view names in the dropdown to select views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to configure views." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1869", + "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1869", + "refsource": "CONFIRM" } ] } diff --git a/2020/2xxx/CVE-2020-2270.json b/2020/2xxx/CVE-2020-2270.json index 57aa9105a5e..10854080019 100644 --- a/2020/2xxx/CVE-2020-2270.json +++ b/2020/2xxx/CVE-2020-2270.json @@ -1,17 +1,65 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-2270", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "jenkinsci-cert@googlegroups.com" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Jenkins project", + "product": { + "product_data": [ + { + "product_name": "Jenkins ClearCase Release Plugin", + "version": { + "version_data": [ + { + "version_value": "0.3", + "version_affected": "<=" + }, + { + "version_value": "0.3", + "version_affected": "?>" + } + ] + } + } + ] + } + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Jenkins ClearCase Release Plugin 0.3 and earlier does not escape the composite baseline in badge tooltip, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1911", + "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1911", + "refsource": "CONFIRM" } ] } diff --git a/2020/2xxx/CVE-2020-2271.json b/2020/2xxx/CVE-2020-2271.json index 65d808c9e2b..0904296db57 100644 --- a/2020/2xxx/CVE-2020-2271.json +++ b/2020/2xxx/CVE-2020-2271.json @@ -1,17 +1,65 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-2271", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "jenkinsci-cert@googlegroups.com" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Jenkins project", + "product": { + "product_data": [ + { + "product_name": "Jenkins Locked Files Report Plugin", + "version": { + "version_data": [ + { + "version_value": "1.6", + "version_affected": "<=" + }, + { + "version_value": "1.6", + "version_affected": "?>" + } + ] + } + } + ] + } + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Jenkins Locked Files Report Plugin 1.6 and earlier does not escape locked files' names in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1921", + "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1921", + "refsource": "CONFIRM" } ] } diff --git a/2020/2xxx/CVE-2020-2272.json b/2020/2xxx/CVE-2020-2272.json index ef7cab79e82..405acf23d34 100644 --- a/2020/2xxx/CVE-2020-2272.json +++ b/2020/2xxx/CVE-2020-2272.json @@ -1,17 +1,65 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-2272", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "jenkinsci-cert@googlegroups.com" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Jenkins project", + "product": { + "product_data": [ + { + "product_name": "Jenkins ElasTest Plugin", + "version": { + "version_data": [ + { + "version_value": "1.2.1", + "version_affected": "<=" + }, + { + "version_value": "1.2.1", + "version_affected": "?>" + } + ] + } + } + ] + } + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A missing permission check in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-862: Missing Authorization" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1903", + "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1903", + "refsource": "CONFIRM" } ] } diff --git a/2020/2xxx/CVE-2020-2273.json b/2020/2xxx/CVE-2020-2273.json index 6f51eef6234..b86c3e43e68 100644 --- a/2020/2xxx/CVE-2020-2273.json +++ b/2020/2xxx/CVE-2020-2273.json @@ -1,17 +1,65 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-2273", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "jenkinsci-cert@googlegroups.com" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Jenkins project", + "product": { + "product_data": [ + { + "product_name": "Jenkins ElasTest Plugin", + "version": { + "version_data": [ + { + "version_value": "1.2.1", + "version_affected": "<=" + }, + { + "version_value": "1.2.1", + "version_affected": "?>" + } + ] + } + } + ] + } + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-352: Cross-Site Request Forgery (CSRF)" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1903", + "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1903", + "refsource": "CONFIRM" } ] } diff --git a/2020/2xxx/CVE-2020-2274.json b/2020/2xxx/CVE-2020-2274.json index 2df12baebad..392b0812657 100644 --- a/2020/2xxx/CVE-2020-2274.json +++ b/2020/2xxx/CVE-2020-2274.json @@ -1,17 +1,65 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-2274", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "jenkinsci-cert@googlegroups.com" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Jenkins project", + "product": { + "product_data": [ + { + "product_name": "Jenkins ElasTest Plugin", + "version": { + "version_data": [ + { + "version_value": "1.2.1", + "version_affected": "<=" + }, + { + "version_value": "1.2.1", + "version_affected": "?>" + } + ] + } + } + ] + } + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Jenkins ElasTest Plugin 1.2.1 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-312: Cleartext Storage of Sensitive Information" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-2014", + "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-2014", + "refsource": "CONFIRM" } ] } diff --git a/2020/2xxx/CVE-2020-2275.json b/2020/2xxx/CVE-2020-2275.json index 6852e315e5d..2295f022e9c 100644 --- a/2020/2xxx/CVE-2020-2275.json +++ b/2020/2xxx/CVE-2020-2275.json @@ -1,17 +1,65 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-2275", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "jenkinsci-cert@googlegroups.com" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Jenkins project", + "product": { + "product_data": [ + { + "product_name": "Jenkins Copy data to workspace Plugin", + "version": { + "version_data": [ + { + "version_value": "1.0", + "version_affected": "<=" + }, + { + "version_value": "1.0", + "version_affected": "?>" + } + ] + } + } + ] + } + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Jenkins Copy data to workspace Plugin 1.0 and earlier does not limit which directories can be copied from the Jenkins controller to job workspaces, allowing attackers with Job/Configure permission to read arbitrary files on the Jenkins controller." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1966", + "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1966", + "refsource": "CONFIRM" } ] } diff --git a/2020/2xxx/CVE-2020-2276.json b/2020/2xxx/CVE-2020-2276.json index d390cac17d3..74e905e97de 100644 --- a/2020/2xxx/CVE-2020-2276.json +++ b/2020/2xxx/CVE-2020-2276.json @@ -1,17 +1,65 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-2276", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "jenkinsci-cert@googlegroups.com" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Jenkins project", + "product": { + "product_data": [ + { + "product_name": "Jenkins Selection tasks Plugin", + "version": { + "version_data": [ + { + "version_value": "1.0", + "version_affected": "<=" + }, + { + "version_value": "1.0", + "version_affected": "?>" + } + ] + } + } + ] + } + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Jenkins Selection tasks Plugin 1.0 and earlier executes a user-specified program on the Jenkins controller, allowing attackers with Job/Configure permission to execute an arbitrary system command on the Jenkins controller as the OS user that the Jenkins process is running as." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1967", + "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1967", + "refsource": "CONFIRM" } ] } diff --git a/2020/2xxx/CVE-2020-2277.json b/2020/2xxx/CVE-2020-2277.json index acef6594ee0..3853047a2c1 100644 --- a/2020/2xxx/CVE-2020-2277.json +++ b/2020/2xxx/CVE-2020-2277.json @@ -1,17 +1,65 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-2277", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "jenkinsci-cert@googlegroups.com" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Jenkins project", + "product": { + "product_data": [ + { + "product_name": "Jenkins Storable Configs Plugin", + "version": { + "version_data": [ + { + "version_value": "1.0", + "version_affected": "<=" + }, + { + "version_value": "1.0", + "version_affected": "?>" + } + ] + } + } + ] + } + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Jenkins Storable Configs Plugin 1.0 and earlier allows users with Job/Read permission to read arbitrary files on the Jenkins controller." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1968%20(1)", + "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1968%20(1)", + "refsource": "CONFIRM" } ] } diff --git a/2020/2xxx/CVE-2020-2278.json b/2020/2xxx/CVE-2020-2278.json index 54928e5b2b2..f98df6d4bbf 100644 --- a/2020/2xxx/CVE-2020-2278.json +++ b/2020/2xxx/CVE-2020-2278.json @@ -1,17 +1,65 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-2278", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "jenkinsci-cert@googlegroups.com" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Jenkins project", + "product": { + "product_data": [ + { + "product_name": "Jenkins Storable Configs Plugin", + "version": { + "version_data": [ + { + "version_value": "1.0", + "version_affected": "<=" + }, + { + "version_value": "1.0", + "version_affected": "?>" + } + ] + } + } + ] + } + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Jenkins Storable Configs Plugin 1.0 and earlier does not restrict the user-specified file name, allowing attackers with Job/Configure permission to replace any other '.xml' file on the Jenkins controller with a job config.xml file's content." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1968%20(2)", + "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1968%20(2)", + "refsource": "CONFIRM" } ] }