Jenkins Aws Codecommit Trigger vulnerabilities
5 known vulnerabilities affecting jenkins/aws_codecommit_trigger.
Total CVEs
5
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
MEDIUM5
Vulnerabilities
Page 1 of 1
CVE-2023-41941MEDIUMCVSS 4.3≤ 3.0.122023-09-06
CVE-2023-41941 [MEDIUM] CWE-862 CVE-2023-41941: A missing permission check in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attack
A missing permission check in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins.
nvd
CVE-2023-41944MEDIUMCVSS 6.1≤ 3.0.122023-09-06
CVE-2023-41944 [MEDIUM] CWE-79 CVE-2023-41944: Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter pa
Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter passed to a form validation URL, when rendering an error message, resulting in an HTML injection vulnerability.
nvd
CVE-2023-41942MEDIUMCVSS 4.3≤ 3.0.122023-09-06
CVE-2023-41942 [MEDIUM] CWE-352 CVE-2023-41942: A cross-site request forgery (CSRF) vulnerability in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 an
A cross-site request forgery (CSRF) vulnerability in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers to clear the SQS queue.
nvd
CVE-2023-41943MEDIUMCVSS 6.5≤ 3.0.122023-09-06
CVE-2023-41943 [MEDIUM] CWE-862 CVE-2023-41943: Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not perform a permission check in an H
Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to clear the SQS queue.
nvd
CVE-2023-35147MEDIUMCVSS 6.5≤ 3.0.122023-06-14
CVE-2023-35147 [MEDIUM] CWE-732 CVE-2023-35147: Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name pa
Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an HTTP endpoint, allowing attackers with Item/Read permission to obtain the contents of arbitrary files on the Jenkins controller file system.
nvd