org.jvnet.hudson.plugins:storable-configs-plugin

4 results · Feed

• High 7.1
  CVE-2022-30972

  Cross Site Request Forgery in Jenkins Storable Configs Plugin

  A cross-site request forgery (CSRF) vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse a local XML file (e.g., archived artifacts) that uses external entities for extraction of secrets from the Jenkins cont…

  Jenkins Project Jenkins Storable Configs Plugin org.jvnet.hudson.plugins:storable-configs-plugin Web / CMS Maven
  May 17, 2022
• High 7.1
  CVE-2022-30971

  XML External Entity Reference in Jenkins Storable Configs Plugin

  Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  Jenkins Project Jenkins Storable Configs Plugin org.jvnet.hudson.plugins:storable-configs-plugin Web / CMS Maven
  May 17, 2022
• Medium 6.5
  CVE-2020-2278

  Arbitrary file write vulnerability in Jenkins Storable Configs Plugin

  Jenkins Storable Configs Plugin 1.0 and earlier does not restrict the user-specified file name, allowing attackers with Job/Configure permission to replace any other '.xml' file on the Jenkins controller with a job config.xml file's content.

  Jenkins Project Jenkins Storable Configs Plugin org.jvnet.hudson.plugins:storable-configs-plugin Web / CMS Maven
  Sep 16, 2020
• Medium 6.5
  CVE-2020-2277

  Arbitrary file read vulnerability in Jenkins Storable Configs Plugin

  Jenkins Storable Configs Plugin 1.0 and earlier allows users with Job/Read permission to read arbitrary files on the Jenkins controller.

  Jenkins Project Jenkins Storable Configs Plugin org.jvnet.hudson.plugins:storable-configs-plugin Web / CMS Maven
  Sep 16, 2020