org.jenkins-ci.plugins:generic-webhook-trigger

3 results · Feed

• Medium 5.3
  CVE-2022-43412

  Non-constant time webhook token comparison in Jenkins Generic Webhook Trigger Plugin

  Jenkins Generic Webhook Trigger Plugin 1.84.1 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook…

  Jenkins Project Jenkins Generic Webhook Trigger Plugin org.jenkins-ci.plugins:generic-webhook-trigger Web / CMS Maven
  Oct 19, 2022
• Medium 5.4
  CVE-2022-25185

  Stored XSS vulnerability in Jenkins Generic Webhook Trigger Plugin

  Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

  Jenkins Project Jenkins Generic Webhook Trigger Plugin org.jenkins-ci.plugins:generic-webhook-trigger Web / CMS Maven
  Feb 15, 2022
• Critical 9.8
  CVE-2021-21669 EPSS 26%

  XXE vulnerability in Jenkins Generic Webhook Trigger Plugin

  Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  Jenkins Project Jenkins Generic Webhook Trigger Plugin org.jenkins-ci.plugins:generic-webhook-trigger Web / CMS Maven
  Jun 18, 2021