Skip to content
OpenAdvisories
High WID-SEC-2024-1234 7 CVEs

Jenkins Plugins: Mehrere Schwachstellen

Published May 26, 2024 · Updated May 26, 2024 · de-DE

Vendor: Jenkins Project Product: Jenkins Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in verschiedenen Jenkins Plugins ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen und um um vertrauliche Informationen offenzulegen.

Product

Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterstützung bei Softwareentwicklungen aller Art.

Vulnerabilities 7

  • Medium 5.9
    CVE-2024-4184

    Multiple XXE sinks in ALM archive post-build step in OpenText Application Automation Tools

    Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below.

    OpenText OpenText Application Automation Tools
  • Medium 5.9
    CVE-2024-4189

    Multiple XXE sinks in Run LoadRunner script step in OpenText Application Automation Tools

    Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below.

    OpenText OpenText Application Automation Tools
  • Medium 5.1
    CVE-2024-4690

    Insecure usage for DocumentBuilderFactory and TransformerFactory in OpenText Application Automation Tools

    Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below.

    OpenText OpenText Application Automation Tools
  • Medium 4.9
    CVE-2024-28793

    IBM Engineering Workflow Management cross-site scripting

    IBM Engineering Workflow Management 7.0.2 and 7.0.3 is vulnerable to stored cross-site scripting. Under certain configurations, this vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potential…

    IBM Engineering Workflow Management
  • Medium 4.3
    CVE-2024-5273

    Jenkins Report Info Plugin Path Traversal vulnerability

    Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files, allowing attackers with Item/Configure permission to retrieve Surefire failures, PMD violations, Findbugs bugs, and Checkstyle e…

    Jenkins Project Jenkins Report Info Plugin org.jenkins-ci.plugins:report-info Web / CMS Maven
  • Low 1.8
    CVE-2024-4211

    Multiple missing permission checks

    Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Access Control Security Levels. Multiple missing permission checks - ALM job config has been discovered…

    OpenText OpenText Application Automation Tools
  • Low 1.8
    CVE-2024-4692

    Multiple missing permission checks

    Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Access Control Security Levels. Multiple missing permission checks - Service Virtualization config has …

    OpenText OpenText Application Automation Tools

Revision history

  1. #1

    Initiale Fassung

References