Jenkins Convertigo Mobile Platform vulnerabilities

4 known vulnerabilities affecting jenkins/convertigo_mobile_platform.

Total CVEs

4

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

HIGH1MEDIUM3

Vulnerabilities

Page 1 of 1

CVE-2022-34200HIGHCVSS 8.8≤ 1.12022-06-23

CVE-2022-34200 [HIGH] CWE-352 CVE-2022-34200: A cross-site request forgery (CSRF) vulnerability in Jenkins Convertigo Mobile Platform Plugin 1.1 a A cross-site request forgery (CSRF) vulnerability in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers to connect to an attacker-specified URL.

CVE-2022-34201MEDIUMCVSS 6.5≤ 1.12022-06-23

CVE-2022-34201 [MEDIUM] CWE-862 CVE-2022-34201: A missing permission check in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attac A missing permission check in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.

CVE-2022-34199MEDIUMCVSS 6.5≤ 1.12022-06-23

CVE-2022-34199 [MEDIUM] CWE-522 CVE-2022-34199: Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

CVE-2022-25210MEDIUMCVSS 6.5≤ 1.12022-02-15

CVE-2022-25210 [MEDIUM] CWE-662 CVE-2022-25210: Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier uses static fields to store job configurat Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier uses static fields to store job configuration information, allowing attackers with Item/Configure permission to capture passwords of the jobs that will be configured.