org.kohsuke.stapler:stapler-parent

3 results · Feed

• Medium 4.3
  CVE-2019-10354

  Missing Authorization in Jenkins

  A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core org.kohsuke.stapler:stapler-parent Web / CMS Maven
  Jul 17, 2019
• Medium 6.5
  CVE-2018-1000997

  Improper Limitation of a Pathname to a Restricted Directory in Jenkins

  A path traversal vulnerability exists in the Stapler web framework used by Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/org/kohsuke/stapler/Facet.java, groovy/src/main/java/org/kohsuke/stapler/jelly/groovy/GroovyFacet.java, jelly/s…

  org.jenkins-ci.main:jenkins-core org.kohsuke.stapler:stapler-parent Maven
  Jan 23, 2019
• Medium 5.4
  CVE-2018-1999007

  Cross-site scripting vulnerability exists in Jenkins and Stapler Plugin

  A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers with the ability to control the existence of some URLs in Jenkins to define Jav…

  org.jenkins-ci.main:jenkins-core org.kohsuke.stapler:stapler-parent Maven
  Jul 23, 2018